Drones & Artificial Intelligence at Greece’s high-tech borders
By Alexandra Karaiskou
In recent years, Greece has been investing significant funds and effort to modernize its border and migration management policy as part of the digitalization of its public sector. This modernization comes in a techno-solutionist shape and form which entails, as the term reveals, an enormous trust in technological solutions for long-standing and complex problems. In the field of border and immigration control, this includes the development, testing and deployment of advanced surveillance systems at the Greek borders, its refugee camps, and beyond to monitor unauthorized mobility, detect threats, and alert authorities for rapid intervention. While these technologies can bring noteworthy benefits, such as more coordinated and rapid responses in emergency situations that could prove critical for saving someone’s life, they also come with significant human rights risks. They can be also used to conduct more frequent and ‘effective’ pushbacks further away from the borders in more invisible and indetectable ways. Significant risks also exist for the rights to privacy, data protection, non-discrimination, and due process, which are undoubtedly among the first to be adversely impacted by the rollout of such technologies.
Although this techno-solutionist trend is not solely a Greek but a global phenomenon, its concretization in the Greek geo-political sphere, a country which manages a considerable portion of Europe’s south-east external borders, is illustrative of the future of European and Member States’ digital border and migration management policies. Technology has “become the ‘servant mistress of politics’”, as Bonditti has eloquently put it, which raises serious concerns about how these systems will be used in practice once deployed, given the systemic pushback and other non-entrée practices documented in the Aegean and Mediterranean seas. And while these technologies are being tested and deployed in a regulatory vacuum, the stakes become even higher.
REACTION: Greece’s latest border surveillance R&D project
As a country traditionally faced with important migratory and refugee inflows due to its geographical location, Greece has gained interest in research and innovation (R&D) projects developing border surveillance technologies. In the past 6 years, it has participated in more than nine EU co-funded projects as a research partner and/or a testing ground, including in the famous ROBORDER, CERETAB and AIDERS projects. In brief, these projects aim at developing various technologies, such as drones and other autonomous robotic vehicles equipped with multimodal cameras; automated early warning systems and innovative information exchange platforms; as well as algorithms (software) that can analyse real-time data and convert it into actionable information for national authorities. Their overall objective is to improve situational awareness around the borders and states’ interception capabilities and preparedness for emergency responses.
Having followed these developments closely from the outset, it came as no surprise when we saw yet another border surveillance project uploaded on the Greek Migration Ministry’s website last fall. This time it is REACTION, a project building on the findings of all the above projects, and co-funded by Greece, Cyprus, and the EU Integrated Border Management Fund. It aims at developing a next generation platform for border surveillance which can provide situational awareness at remote frontier locations as an efficient tool for rapid response to critical situations. Responding to irregular immigration, smuggling, human trafficking and, overall, transnational organised crime is described as the main driver behind the development of REACTION. The system will consist of several components, such as drones that can be used in swarm or solo formations, computer vision (via deep learning techniques), object recognition, identification and characterisation of events, early warning systems, as well as big data analytics. In simpler terms, software trained on machine learning techniques will analyse instantly the vast amounts of data collected by the drones and other sensors connected to the system and produce an alert identifying the type of incident and its coordinates. Depending on its design features, it may also offer additional tools to the authorities, such as the possibility to follow an unidentified object or person, zoom in and potentially cross-reference their distinctive features (ex. a person’s facial image) with data stored in existing databases. It is worth noting that REACTION will be interoperable with the servers of the Greek law enforcement authorities, and Reception and Identification Centres (RICs, i.e. refugee camps, analysed below), as well as EUROSUR, the EU border surveillance system operated by the EU Border and Coast Guard Agency, thereby drawing a wealth of information from various national and European sources.
Such systems come with the hope of revolutionising border management by elevating authorities’ detection and intervention capabilities to the next level. To what end, whether to save lives or let die, remains to be seen. Unfortunately, the country’s recent track record in emergency responses at the border, as evidenced by the recent shipwreck off Pylos and numerous other pushback incidents, leaves little room for optimism. Moreover, the deployment of such a tool might also undermine the right to privacy and data protection, among others, to the extent that anyone approaching the border could become a potential target of surveillance, whose sensitive biometric data could be unknowingly processed. It may still be soon to tell how this system will be implemented in the future, but the widening of power asymmetries between state authorities and vulnerable individuals along with the current state of practice paint a very alarming picture.
Hyperion & Centaur: the new surveillance systems at Greece’s refugee camps
Another area where new surveillance technologies are being piloted is Greece’s refugee camps. The Greek Ministry of Migration currently develops seven projects for the digitalisation of the asylum procedure and the camps’ management. One of them, Hyperion, which is expected to be deployed soon, will be the new management system of all the RICs, closed centres, and shelters. It will register asylum seekers’ personal data, both biographic (ex. full name, date and country of birth, nationality, etc.) and biometric (fingerprints), and will be the primary tool for controlling their entry in and exit from the camp by scanning their asylum seeker’s card and a fingerprint. It will also store information about most services provided to them, such as food, clothing, etc., and their transfers from one camp to another. In the near future, asylum seekers’ moves will be closely and continuously scrutinized by this system, as if they were inmates in high security prisons, which leads to highly intrusive practices that are difficult to justify. Besides surveillance, another objective of Hyperion is to enforce strict discipline to the state’s power: if someone, for instance, leaves the camp and does not return within the authorised time period, they could lose their access to the camp and to the rest of the services provided to them, leaving them homeless and without the most basic living conditions. Noteworthily, Hyperion will also be interoperable with an asylum seeker’s digital case file at the Asylum Service, which means that any alert in the system about a breach of the camp’s rules may have negative implications on their asylum claim. In the example above, unjustified absence from the camp could lead to the rejection of their asylum application, exposing them to the risk of detention and deportation.
In addition, Centaur is the new high-tech security management system of the camps that will automatically detect security breaches and alert the authorities. It consists of drones, optical and thermal cameras, microphones, metal detectors, and advanced motion detectors based on AI-powered behavioural analytics that monitor the internal and surrounding area of the camp. It is connected to a centralised control room in the Ministry’s headquarters in Athens and produces red flags whenever a security threat is detected, such as fights, unauthorized objects, fires, etc. From there, Ministry employees can zoom in and assess the risk, and instruct personnel on the ground on where and how to intervene. It has already been piloted at several camps and works complementarily to Hyperion by surveilling whatever move has been left unmonitored. In practice, the only places where people can enjoy some privacy is the bathrooms and to a certain extent the insides of their rooms. In the words of the 25-year-old refugee living in Samos camp: “there’s not a lot of difference between this camp and a prison”.
Although these systems have been promoted by the Greek authorities as efficient tools to ensure asylum seekers’ safety, this certainly comes at a high cost for privacy and fundamental rights. Besides their right to privacy, which is obviously seriously restricted, their right to non-discrimination or due process could be adversely affected, if the use of these systems leads to biased decisions or summary rejections of asylum applications. Moreover, their right to data protection is also severely compromised. Importantly, no Data Protection Impact Assessment seems to have been conducted, although required by the GDPR; and no regulatory framework has been adopted yet to govern the use (and potential misuse) of these systems, and mitigate these and other human rights risks. While the Ministry’s radio silence on these issues echoes loudly, we look forward to the findings of the Greek DPA’s investigation and trust them to ensure the protection of all persons’ rights in the digital era, regardless of where they are coming from.
Four steps to compliance today
Although the deadlines are further down the line, affected organizations do not have to sit and wait. Time (and money) is precious when preparing to achieve compliance with the NIS2 and DORA requirements. Organizations must assess and identify actions they can take to prepare for the new rules.
The following recommendations are a good starting point:
Governance and risk management: Understand the new requirements and evaluate the current governance and risk management processes. Additionally, consider increasing funding for programs that help detect threats and incidents and strengthening enterprise-wide cybersecurity awareness training initiatives.
Incident reporting: Evaluate the maturity of incident management and reporting to understand current state capabilities and gauge awareness of the various cybersecurity incident reporting standards relevant to your industry. You should also check your ability to recognize near-miss situations.
Resilience testing: Recognize the talents needed to design and carry out resilience testing, including board member training sessions on the techniques used and their implications for repair.
The Challenge of Complying with New EU Legislative Security Requirements
By Anastasios Arampatzis and Eleftherios Chelioudakis
Over the past years, the number of digital policy initiatives at the EU level has expanded. Many legislative proposals covering Information and Communication Technologies (ICT) and influencing the rights and freedoms of people in the EU have been adopted, while others remain under negotiations. Most of these legislative acts are crucial, dealing with a wide range of complex topics, such as AI, data governance, privacy and freedom of expression online, access to digital data by law enforcement authorities, e-health, and cybersecurity.
Civil society actors often need help to follow the EU policy initiatives, while businesses face severe challenges in understanding the complex legal language of the legislative requirements. This article aims to raise awareness about two recently adopted EU legislations on cybersecurity, namely the Digital Operational Resilience Act (DORA) and the revised version of the Network and Information Security Directive (NIS2).
NIS2
NIS2 is the much-needed response to the expanding landscape threatening critical European infrastructure.
The original version of the Directive introduced several obligations for national supervision of operators of essential services (OES) and critical digital service providers (DSP). For example, EU Member states must supervise the cybersecurity level of operators in critical sectors, such as energy, transport, water, healthcare, digital infrastructure, banking, and financial market infrastructures. Moreover, Member States must supervise critical digital service providers, including online marketplaces, cloud computing services, and search engines.
For this reason, the EU Member States are to establish competent national authorities in charge of these supervisory tasks. In addition, NIS introduced channels for cross-border cooperation and information sharing between the EU Member States.
However, the digitalization of services and the increased level of cyberattacks throughout the EU led the European Commission in 2020 to propose a revised version of the NIS, namely NIS2. The new Directive entered into force on 16 January 2023, and the Member States now have 21 months, until 17 October 2024, to transpose its measures into national law.
The new Directive has broadened the scope of the NIS to strengthen the security requirements imposed in EU Member States, streamline reporting obligations, and introduce more robust supervisory measures and stricter enforcement requirements, such as harmonized sanctions regimes across EU Member States.
NIS2 introduces the following aspects:
- Expanded applicability: NIS2 increases the number of sectors covered by its provisions, including postal services, car manufacturers, social media platforms, waste management, chemical production, and agri-food. The new rules classify the entities into ‘Essential entities’ and ‘Important entities’ and apply to subcontractors and service providers operating within the covered sectors.
- Increased readiness for global cyber threats: NIS2 seeks to enhance collective situational awareness among essential entities to identify and communicate related threats before they expand across Member States. For example, the EU-CyCLONe network will assist in coordinating and managing large-scale incidents, while a voluntary peer-learning mechanism will be established to support awareness.
- Streamlined resilience standards with stricter penalties. Unlike NIS, NIS2 provides for high penalties and robust security measures. For example, infringements by essential entities shall be subject to administrative fines of a maximum of at least €10 million or 2% of their total global annual turnover, while important entities shall be fined a maximum of at least €7 million or 1.4 % of their total global annual turnover.
- Streamlined reporting processes. NIS2 streamlines the reporting obligations to avoid causing over-reporting and creating an excessive burden on the entities covered.
Expanded territorial scope: According to the new rules, specific categories of entities not established in the European Union but offering services within it will be obliged to designate a representative in the EU.
DORA
The Digital Operational Resilience Act (DORA) addresses a fundamental problem in the EU financial ecosystem: how the sector can stay resilient during severe operational disruption. Before DORA, financial institutions used capital allocation to manage the significant operational risk categories. However, they need to better address and integrate cybersecurity resilience into their larger operational frameworks in the evolving threat landscape.
The European Council press release provides a comprehensive statement of the purpose of the Digital Operational Resilience Act:
“DORA sets uniform requirements for the security of network and information systems of companies and organizations operating in the financial sector as well as critical third parties which provide ICT (Information Communication Technologies)-related services to them, such as cloud platforms or data analytics services.”
In other words, DORA creates a homogeneous regulatory framework on digital operational resilience to ensure that all financial entities can prevent and mitigate cyber threats.
Per Article 2 of the Regulation, DORA applies to financial entities, including banks, insurance companies, investment firms, and crypto-asset service providers. The Regulation also covers critical third parties offering financial companies IT and cybersecurity services.
Because DORA is a Regulation and not a Directive, it is enforceable and directly applicable in all EU Member States from its application date. DORA supplements the NIS2 directive and addresses possible overlaps as “lex specialis”.
DORA compliance is broken down into five pillars covering diverse IT and cybersecurity facets, giving financial firms a thorough foundation for digital resilience.
- ICT risk management: Internal governance and control processes ensure the effective and sensible management of ICT risk.
- ICT-related incident management, classification, and reporting: Detect, manage and alert ICT-related incidents by defining, establishing and implementing a cybersecurity incident response and management process.
- Digital operational resilience testing: Evaluate readiness for managing cybersecurity incidents, spot flaws, shortcomings, and gaps in digital operational resilience, and swiftly put corrective measures in place.
- Managing ICT third-party risk: This is an integral component of cybersecurity risk within the ICT risk management framework.
- Information sharing: Exchange cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures (TTP), and cybersecurity alerts, to enhance the resilience of financial entities.
According to Article 64, the Regulation entered into force on 17 January 2023 and “shall apply from 17 January 2025.” It is also important to note that Article 58 specifies that by 17 January 2026, the European Commission shall review “the appropriateness of strengthened requirements for statutory auditors and audit firms as regards digital operational resilience.”
Four steps to compliance today
Although the deadlines are further down the line, affected organizations do not have to sit and wait. Time (and money) is precious when preparing to achieve compliance with the NIS2 and DORA requirements. Organizations must assess and identify actions they can take to prepare for the new rules.
The following recommendations are a good starting point:
- Governance and risk management: Understand the new requirements and evaluate the current governance and risk management processes. Additionally, consider increasing funding for programs that help detect threats and incidents and strengthening enterprise-wide cybersecurity awareness training initiatives.
- Incident reporting: Evaluate the maturity of incident management and reporting to understand current state capabilities and gauge awareness of the various cybersecurity incident reporting standards relevant to your industry. You should also check your ability to recognize near-miss situations.
- Resilience testing: Recognize the talents needed to design and carry out resilience testing, including board member training sessions on the techniques used and their implications for repair.
- Third-party risk management: To assist in creating a risk containment plan, concentrate on enhancing contract mapping and assessing third-party vulnerabilities. Recognize the services that are essential for hosting fundamental business processes. Check to see if a fault-tolerant architecture has been implemented to lessen the impact of critical provider disruption.
This article was prepared as part of the project “Increasing Civic Engagement in the Digital Agenda — ICEDA” with the support of the European Union and South East Europe (SEE) Digital Rights Network. The content of this article in no way reflects the views of the European Union or the SEE Digital Rights Network.
Photo by FLY:D on Unsplash
Four steps to compliance today
Although the deadlines are further down the line, affected organizations do not have to sit and wait. Time (and money) is precious when preparing to achieve compliance with the NIS2 and DORA requirements. Organizations must assess and identify actions they can take to prepare for the new rules.
The following recommendations are a good starting point:
Governance and risk management: Understand the new requirements and evaluate the current governance and risk management processes. Additionally, consider increasing funding for programs that help detect threats and incidents and strengthening enterprise-wide cybersecurity awareness training initiatives.
Incident reporting: Evaluate the maturity of incident management and reporting to understand current state capabilities and gauge awareness of the various cybersecurity incident reporting standards relevant to your industry. You should also check your ability to recognize near-miss situations.
Resilience testing: Recognize the talents needed to design and carry out resilience testing, including board member training sessions on the techniques used and their implications for repair.
Raising Awareness Is Critical for Privacy and Data Protection
By Anastasios Arampatzis
Many believe cybersecurity and privacy are about emerging technologies, processes, hackers, and laws. Partially this is true. Technology is pervasive and has changed drastically how we live, work and communicate. High-profile data breaches make the news headlines more frequently than not, and businesses are fined enormous penalties for breaking security and privacy laws.
However, they must remember the most important pillar of data protection and privacy; the human element. Hymans create and use technology, and it is humans who even develop the regulations that govern a respectful and ethical use of technology. What is more, humans mostly feel the impact of data breaches. The human element is also responsible for the majority of data breaches. The Verizon Data Breach Investigations Report highlights that humans are responsible for 82% of successful data breaches.
If this percentage seems high, imagine that many security professionals argue that it is instead closer to 100%. Flawed applications, for example, are the artifact of humans. People manufacture insecure Internet of Things (IoT) devices. And it is humans that choose weak passwords or reuse passwords across multiple applications and platforms.
This is not to imply that we should accuse people of being “the weakest link” in cybersecurity and privacy. On the contrary, these thoughts underline the importance of individuals in preserving a solid security and privacy posture. This demonstrates how essential it is to create a security and privacy culture. Raising awareness about threats and best practices becomes the foundation of a safer digital future.
Data Threats Awareness
Our data is collected daily — your computer, smartphone, and almost every internet-connected device gather data. When you download a new app, create a new account, or join a new social media platform, you will often be asked to provide access to your personal information before you can even use it! This data might include your geographic location, contacts, and photos.
For these businesses, this personal information about you is of tremendous value. Companies use this data to understand their prospects better and launch targeted marketing campaigns. When used properly, the data helps companies better understand the needs of their customers. It serves as the basis for personalization, improving customer service, and creating customer value. They help to understand what works and what doesn’t. They also form the basis for automated and repeatable marketing processes that help companies evolve their operations.
In an article from May 2017, The Economist defined the data industry as the new oil industry. According to LSE Business Review, advertisements accounted for 92% of Facebook’s revenue and above 90% of Google’s revenue. This revenue is equal to approximately 60 billion $.
This is the point where things derail. Businesses store personal data indefinably. They use data to make inferences about your socioeconomic status, demographic information, and preferences. The Cambridge Analytica scandal was a great manifestation of how companies can manipulate our beliefs based on the psychographic profiles created by harvesting vast amounts of “innocent” personal data. Companies do not always use your data to your interest or according to your consent. Google, Apple, Facebook, Amazon, and Microsoft generate value by exploiting them, selling them (for example, via a data broker), or exchanging them for other data.
Besides the threats originating from the misuse of our data by legitimate businesses, there is always the danger coming from malicious actors who actively seek to spot gaps in data protection measures. The same Verizon report indicates that personal data are the target in 76% of data breach incidents. The truth is that data is valuable to criminals as well.
According to Keeper Security, criminals sell your stolen data in the dark web market, doing a profitable business. A Spotify account costs $2.75, a Netflix account up to $3.00, a driver’s license $20.00, a credit card up to $22.00, and a complete medical record $1.000! Now multiply these prices per unit by the million records compromised yearly, and you have a sense of the booming cybercrime economy.
Privacy Best Practices Awareness
If this reality is sending chills down your spine, don’t fret! You can take steps to control how your data is shared. You can’t lock down all your data — even if you stop using the internet, credit card companies and banks record your purchases. But you can take simple steps to manage it and take more control of whom you share it with.
First, it is best to understand the tradeoff between privacy and convenience. Consider what you get in return for handing over your data, even if the service is free. You can make informed decisions about sharing your data with businesses or services. Here are a few considerations:
-Is the service, app, or game worth your personal data?
-Can you control your privacy and still use the service?
-Is the data requested relevant to the app or service?
-If you last used an app several months ago, is it worth keeping it, knowing that it might be collecting and sharing your data?
You can adjust the privacy settings to your comfort level based on these considerations. Check the privacy and security settings for every app, account, or device. These should be easy to find in the Settings section and usually require a few minutes to change. Set them to your comfort level for personal information sharing; generally, it’s wise to lean on sharing less data, not more. You don’t have to adjust the privacy settings for every account at once; start with some apps, which will become a habit over time.
Another helpful habit is to clear your cookies. We’ve all clicked “accept cookies” and have yet to learn what it means. Regularly clearing cookies from your browser will remove certain information placed on your device, often for advertising purposes. However, cookies can pose a security risk, as hackers can easily hijack these files.
Finally, you can try privacy-protecting browsers. Looking after your online privacy can feel complicated, but specific internet browsers make the task easier. Many browsers depreciate third-party cookies and have strong privacy settings by default. Changing browsers is simple but can be very effective for protecting your privacy.
Data Protection Best Practices Awareness
Data privacy and data protection are closely related. Besides managing your data privacy settings, follow some simple cybersecurity tips to keep it safe. The following four steps are fundamental for creating a solid data protection posture.
-Create long (at least 12 characters) unique passwords for each account and device. Use a password manager to store all your passwords. Maintaining dozens of passwords securely is easier than ever, and you only need to remember one password.
-Turn on multifactor authentication (MFA) wherever permitted, even on apps that are about football or music. MFA can help prevent a data breach even if your password is compromised.
-Do not deactivate the automatic updates that come as a default with many software and apps. If you choose to do it manually, make sure you install these updates as soon as they are available.
-Do not click on links or attachments included in phishing messages. You can learn how to spot these emails or SMS by looking closely at the content and the sender’s address. If they promote urgency and fear or seem too good to be true, they are probably trying to trick you. Better safe than sorry.
This article was prepared as part of the project “Increasing Civic Engagement in the Digital Agenda — ICEDA” with the support of the European Union and South East Europe (SEE) Digital Rights Network. The content of this article in no way reflects the views of the European Union or the SEE Digital Rights Network.
A big success for Homo Digitalis: The Hellenic DPA fines CLEARVIEW AI with €20 million
Today, following a complaint filed by Homo Digitalis in May 2021 representing our member and data subject Marina Zacharopoulou, the Hellenic Data Protection Authority (HDPA) issued Decision 35/2022 imposing a fine of 20 million euros on Clearview AI for its intrusive practices. This is the highest GDPR fine, ever imposed by the Hellenic DPA. By the same Decision, the DPA prohibits that company from collecting and processing the personal data of data subjects located in Greece using facial recognition methods and requires it to delete immediately any data it has already collected.
Specifically, in May 2021, an alliance of civil society organizations consisting of Homo Digitalis and the organizations Privacy International, Hermes Center, and noyb filed complaints before the competent authorities in Greece, the United Kingdom, Italy, Austria, France and the United Kingdom against Clearview AI for its mass surveillance practices through facial recognition.
Earlier this year, the Italian Data Protection Authority had decided to fine the company €20 million, while the UK’s equivalent authority had decided to fine it £7.5 million.
The €20 million fine imposed by the DPA today is another strong signal against intrusive business models of companies that seek to make money through the illegal processing of personal data. At the same time, it sends a clear message to law enforcement authorities working with companies of this kind that such practices are illegal and grossly violate the rights of data subjects.
Clearview AI is an American company founded in 2017 that develops facial recognition software. It claims to have “the largest known database of more than three billion facial images” which it collects from social media platforms and other online sources. It is an automated tool that visits public websites and collects any images it detects that contain human faces. Along with these images, the automated collector also collects metadata that complements these images, such as the title of the website and its source link. The collected facial images are then matched against the facial recognition software created by Clearview AI in order to build the company’s database. Clearview AI sells access to this database to private companies and law enforcement agencies, such as police authorities, internationally.
The full text of Decision 35/2022 can be found here (only in EL).
A major success for civil society in Greece: The Hellenic DPA launches an investigation into the Ministry of Immigration and Asylum re the YPERION and KENTAYROS IT systems
On Wednesday 2 March, the Hellenic Data Protection Authority (DPA) launched an investigation into the Ministry of Immigration and Asylum regarding the supply and installation of the YPERION and KENTAYROS systems in reception and accommodation facilities for asylum seekers.
Specifically, following the successful submission of a request submitted on 18 February by the organisations (in alphabetical order) Hellenic League for Human Rights, HIAS Greece, and Homo Digitalis together with the Lecturer of Queen Mary University of London Dr. Niovi Vavoula before the President of the Hellenic DPA, the Authority addressed a communication to the Ministry of Immigration and Asylum inviting it to inform it immediately about:
– the specific legal basis for the processing of personal data in the context of the operation of YPERION and KENTAYROS systems; and
– the carrying out of an impact assessment study on the impact of the processing on the protection of personal data, taking into account that in the case of the procurement of surveillance and monitoring systems, the carrying out of an impact assessment regarding their operation must be carried out not only before their operation, but also before their procurement, in order to comply with the principles of data protection by design and by default.
As the DPA states, together with the request for investigation we had filed, they had also received a request for information from the European Parliament’s Civil Liberties, Justice and Home Affairs Committee (LIBE Committee) on the surveillance technologies generally used at our country’s borders.
We recall that the YPERION system will be the asylum seeker management system with regard to all the needs of the Reception and Identification Service and will be responsible for access control (entry – exit via security turnstiles), by showing an individual card of a migrant, NGO member, worker and simultaneous use of fingerprints), the monitoring of benefits per asylum seeker using an individual card (food, clothing supplies, etc.) and the movements between the centres, KIDNs and Accommodation Facilities. The KENTAYROS system will be the digital system for managing electronic and physical security around and inside the facilities, using cameras and Artificial Intelligence Behavioral Analytics algorithms.
You can read the relevant letter sent by the DPA to the Ministry of Immigration and Asylum here.
You can read more about the joint request for research filed in February here.
ΕDRi and other 70 CSOs call EU Member States to take the right approach during DSA trilogue
Ahead of the #DigitalServicesAct negotiations, EDRi, Amnesty International, Civil Liberties Union for Europe and 69 civil society organisations call on 20 ministries and state secretaries in the Netherlands, Denmark, Germany, France, Spain, Italy, Luxembourg, Austria, Croatia to BAN #DarkPatterns and pervasive online tracking practices and preserve privacy.
If done right, the #DSA can ensure that you are part of a rights-respecting online environment, in which you have the power to make truly informed choices and where the online advertising industry respects your rights and freedoms.
During the ongoing Trilogue negotiations, we urge the Member States to defend people and push against toxic #BigTech business models. .
You can read our joint letter here.
Urging EU to ban AI predictive & profiling systems in law enforcement & criminal justice
AI systems are used to profile people and areas to predict crime, leading to over-policing, surveillance and imprisoning of racialised groups.
That’s why 40+ civil rights organisations led by EDRi and Fair Trials urge the EU to BAN AI predictive & profiling systems in law enforcement & criminal justice in the #AIAct.
Affected people must have clear & effective routes to challenge the use of these systems.
Read the full statement here.
The Hellenic DPA is requested to take action again the deployment of ICT systems IPERION & KENTAUROS in facilities hosting asylum seekers in Greece
Homo Digitalis together with The Hellenic League for Human Rights, HIAS Greece and Dr. Niovi Vavoula, Lecturer at Queen Mary University of London submitted before the President of the Hellenic Data Protection Authority (HDPA) on 18.2.2022, a request for the exercise of its investigative powers regarding the deployment of the ICT systems IPERION and KENTAUROS in facilities hosting asylum seekers in Greece (protocol number 2515/18.02.2022).
In particular, as described in the relevant website of the Ministry of Digital Governance for the area of migration and asylum, as well as in the annual action plan of the Ministry of Immigration and Asylum:
-The ΙPERION system will be the asylum seekers’ management system with regard to all the needs of the Reception and Identification Services. It will include a detailed record of the data of asylum seekers and it will be interconnected with the ALKYONI II system with regard to the asylum application. In addition, it will be the main tool for the operation of all related facilities as it will be responsible for access control (entry – exit through security turnstiles, with the presentation of an individual card of a migrant, NGO member, worker and simultaneous use of fingerprints), the monitoring of benefits per asylum seeker using an individual card (food, clothing supplies, etc.) and movements between the different facilities. At the same time, the project includes the creation of a mobile phone application that will provide personalized information to the user, will be his/her electronic mailbox regarding his/her asylum application process and will enable the Service to provide personalized information. It is important to note that the IPERION system is presented by the Ministry of Digital Governance as a system that will be completed in the medium term and its construction – installation is already underway. Furthermore, explicit reference is made to this system in Article 7(2) of the General Regulation on the Operation of Closed Controlled Island Facilities. Therefore, it is understood that the IPERION system will process biometric and biographical data of asylum seekers, as well as of NGO members visiting the relevant structures and of people working in them.
-The KENTAUROS system will be a digital system for managing electronic and physical security around and inside the facilities, using cameras and Artificial Intelligence Behavioral Analytics algorithms. It includes centralised management from the headquarters of the Ministry of Digital Governance and the following services: Signaling perimeter breach alarms using cameras and motion analysis algorithms; signaling of illegal behavior alarms of individuals or groups of individuals in assembly areas inside the facility; and use of unmanned aircraft systems to assess incidents inside the facility without human intervention, among other functions. It is noted that the KENTAUROS system is presented by the Ministry of Digital Governance as a system that will be completed in the medium term and its construction – installation is planned. Therefore, it is understood that the KENTAUROS system is incorporating highly intrusive technologies, such as behaviour analysis algorithms, drones and closed circuit surveillance cameras, which create important for challenges for the protection of privacy, personal data and other rights
It is worth noting that Homo Digitalis submitted on 13 October 2021 a request for information re IPERION and KENTAUROS systems before the Secretary General for Asylum Seekers of the Ministry of Immigration and Asylum, Mr Logothetis. Nevertheless, Homo Digitalis did not receive a response from the competent bodies, even though the relevant deadline for reply has already expired.
Based on all of the above, it is understood that there is a serious risk that the installation of these systems could violate the European Union legislation on the processing of personal data and the provisions of Law 4624/2019, while there is also a significant risk that the installation of these systems without the preparation of the necessary Data Protection Impact Assessment may cause a serious violation of the rights and freedoms of data subjects who are hosted in this facilities, visit the facilities, or are employed in them. Finally, the possible creation of databases (including biometric data and other special categories of data) to assist the operation of these systems is not foreseen by any national legal rule providing the necessary safeguards for the rights of data subjects, thus raising significant challenges.
The Hellenic Coast Guard wants to acquire social media monitoring software: The Hellenic DPA is urged to exercise its investigative and supervisory powers
Homo Digitalis together with The Hellenic League for Human Rights, HIAS Greece, Privacy International and the researcher Phoebus Simeonidis submitted before the President of the Hellenic Data Protection Authority (HDPA) on 14.2.2022, a request for the exercise of its investigative powers regarding a procurement tender published by the Hellenic Coast Guard for the acquisition of a Social Media Data Collection Software (protocol number 2322/15/2/22 ).
Specifically, as pointed out on 2/2/2022 by researcher Phoebus Simeonidis, in the framework of the European Commission’s “Internal Security Fund” (ISF) program, the Coast Hellenic Guard – Ministry of Maritime Affairs published a tender for the “Upgrade/maintenance of the computer room of the Directorate of Maritime Border Security and Protection” with a total estimated contract value of seven hundred and thirty thousand euros #730.000,00€# (including VAT and other deductions).
One of the deliverables described in this call for tender (see page 34 et seq.) is the supply of Social Media Data Collection Software (hereinafter referred to as Software). As explicitly stated by the Ministry of Maritime Affairs in this notice, the Software should support the social networks Facebook, Twitter, VK, Xing, Instagram, and Telegram, and some of the necessary features as described are:
– The creation of a visualization of multiple correlations (friends, comments, posts, likes and followers).
– The identification of user identifiers including their searches, and
– The simulation of human activity to avoid account blocking.
Specifically for Facebook, the software should allow, among other functions, storage of a profile’s public contact list, storage of all 2nd degree public contacts, storage of public timeline posts (including images, videos, linked YouTube videos, comments and reactions), storage of image galleries, storage of published account information (employer, residences, education), and searching accounts for specific personal characteristics.
With respect to Twitter, the Software should, among other functions, allow for the storage of audience following a profile list, storage of all public contacts of the 2nd degree (Followers List), and storage of public messages (including images, videos, linked YouTube videos, and likes).
For Instagram, the Coast Guard is seeking the Software to allow, among other things, storage of the follower list, storage of the public list following a profile, storage of public comments per profile by time sequence including images, videos, linked YouTube videos, and storage of timelines and Profile Stories.
With regard to Telegram, the software must allow the storage of participants in group conversations (up to 10,000 participants), as well as the storage of the full content of each group conversation (text and photos or other material shared in them).
It is therefore clear that the software in question seeks to monitor an indeterminately large number of users of the social networks in question, and to collect, process and analyse their information, without indicating the purpose of the processing operations, the legal bases that allow them and any other safeguards for the protection of personal data, as the European Data Protection Supervisor has expressly stated in a case of similar software maintained by the European Support Office for It is also worth noting that the European Border and Coast Guard Agency (FRONTEX) had in 2019 withdrawn a related call for tender for the procurement of similar social media data collection software, following a successful action by Privacy International.
Thus, the procurement of this software will be a clear challenge to the right to the protection of personal data and respect for the principle of lawfulness of processing, the principle of purpose limitation and the principle of proportionality (data minimisation) as outlined in EU and national legislation, as well as the rights to respect for privacy and freedom of expression.
Also, the creation of a fake account simulating human activity is contrary to the terms of use of social media and messaging mentioned in the tender, while the logging of searches of third party accounts is a highly intrusive activity. Of course, highly intrusive is also the recording and monitoring of group conversations on Telegram.