BRUSSELS—The U.S. and the European Union are aligning rules to help crime-fighters access suspects’ emails, text messages, photos and other data, despite simmering trans-Atlantic tensions.

The European Commission proposed Tuesday that national law enforcement authorities be allowed to access data stored on tech companies’ servers in other EU countries or the U.S., to speed cross-border criminal investigations. Tech firms that don’t comply risk fines. </s> Plan to gather evidence of crime and terrorism ‘quickly and efficiently across borders’

This article is more than 1 year old

This article is more than 1 year old

The European commission is seeking to force technology companies wherever they are based in the EU to hand over emails, text messages and app communications of terror suspects within hours of a court order.

Under the plans, judges in one member state will be able to seize electronic evidence held on a service provider in another European country through a transnational European production order.

The powers would further cover the seizure of data held outside the EU by a tech company “offering services in the union and established or represented” in an EU member state.

The information will have to be handed over by the service provider within 10 days of receiving the warrant, or as little as six hours in emergency cases.

Currently, depending on the legal vehicle, the time limits before which the tech companies need to respond to national courts can vary between 120 days to 10 months.

Frans Timmermans, the European commission’s vice-president, said: “Electronic evidence is increasingly important in criminal proceedings. We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice.

“There must be no hiding place for criminals and terrorists in Europe, online or offline. Today’s proposals will put in place unprecedented tools enabling the competent authorities not only to gather electronic evidence quickly and efficiently across borders but also ensuring robust safeguards for the rights and freedoms of all affected.”

The tech companies will also be under an obligation not to delete specific types of data.

European Digital Rights, a campaigning group, has warned that the measures pose a threat to people’s fundamental rights. However, the commission insisted that the order would only be applicable in the most serious of cases, and that all the normal safeguards of the judicial process would be in place.

More than half of all criminal investigations include a cross-border request to obtain electronic evidence, the commission said. The current ways to obtain such data were said to be “much too slow and cumbersome”. Almost two-thirds of crimes where electronic evidence is held in another country cannot be properly investigated or prosecuted, officials added.

The commission also wants to give law enforcement authorities access to bank account information, no matter where the data is held, in an effort to cut of the financing of terror groups active in Europe.

The level of information will be limited, however, to that held in national, centralised registries enabling the authorities to identify in which banks a suspect holds accounts.

As part of the roll-out of new initiatives devised in response to attacks on European soil in recent years, the EU is also seeking to improve the security features of ID cards used by citizens of member states in the Schengen travel area. Fingerprints and facial images will be stored on a chip in the cards.

An estimated 80 million Europeans currently have non-machine-readable ID cards without biometric identifiers.

Julian King, the UK’s European commissioner, responsible for security, said: “By giving law enforcement access to crucial pieces of financial information, we are closing another loophole being exploited by terrorists, and hitting them where it hurts – their finances.” </s> Tech giants such as Facebook, Skype or Google will be forced to hand over data to crime and terror investigators in other EU countries under new laws put forward by the European Commission.

Companies will have to respond to requests for emails, texts or messages in apps within 10 days or six hours in case of emergencies, regardless of where the data is held, if the proposal becomes EU law.

More than half of all criminal investigations now include a cross-border request to obtain electronic evidence held in another country in or outside the EU. But two thirds of those probes cannot be properly prosecuted because the current system is too cumbersome.

The new European Production Order will allow... </s> Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The European Union executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

"Electronic evidence is increasingly important in criminal proceedings," said European Commission Vice-President Frans Timmermans.

"We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice."

Digital borders are a growing global issue in an era where big companies operate so-called cloud networks of giant data centres, which mean that an individual's data can reside anywhere.

Technology companies have found themselves torn between protecting consumers' privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that U.S. judges could issue warrants for data held abroad while giving companies an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

They will also be able to ask companies to ensure electronic evidence is not deleted while they prepare their so-called production order.

Fraught with complexity

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement.

Where companies find themselves in a conflict-of-law situation because the country where data is stored forbids them from handing it over to a foreign authority, they will be able to challenge the seizure request.

However, such extraterritorial rules are fraught with complexity, legal and privacy experts warn.

In the United States, for example, certain companies are prohibited from disclosing information to foreign governments, while in Europe consumers' data privacy is strictly protected and companies are restricted in how they can transfer data outside the bloc.

"The Commission is proposing dangerous shortcuts to allow national authorities to obtain people's data directly from companies, basically turning them into judicial authorities," said Maryant Fernandez Perez, senior policy adviser at campaign group European Digital Rights.

CCIA, a tech association that includes Google and Facebook, welcomed the proposal but said it only offered a limited mechanism for addressing the risk that companies find themselves torn between two conflicting national laws.

"We welcome today's proposals, which can help authorities obtain digital evidence more effectively and with more transparency and legal clarity," said Alexandre Roure, CCIA Europe's senior manager.

Ultimately, the Commission hopes to start talks with the United States on a deal to help law enforcement authorities to seize evidence held on each other's territories.

"We always think it's useful to have an EU-US coordinated approach instead of a French-US approach, a Belgian-US approach because that leads to fragmentation," a Commission official said. </s> Technology companies such as Google, Microsoft and Facebook will be forced to hand over users’ data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the European Union yesterday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The EU executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

“Electronic evidence is increasingly important in criminal proceedings,” said European Commission Vice President Frans Timmermans.

“We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice.”

On the frontline of the ongoing investigation into claims that Cambridge Analytica may have illegally harvested Facebook data for political ends, former CA boss Alexander Nix has refused to appear for a second grilling by British lawmakers, the MPs’ scrutiny panel investigating him said yesterday.

The ex-CA chief executive was due to appear today before parliament’s culture, media and sport committee over the British political consultancy firm’s highly controversial work. They wanted to probe inconsistencies in the testimony he gave before the committee on February 27.

Digital borders are a growing global issue in an era where big firms operate so-called cloud networks of giant data centers, which means that an individual’s data can reside anywhere.

Technology companies have found themselves torn between protecting consumers’ privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that US judges could issue warrants for data held abroad while giving firms an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement. </s> related media assets (image or videos) available. Click to see the gallery.

2 related media assets (image or videos) available. Click to see the gallery.

Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

BRUSSELS: Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The European Union executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

"Electronic evidence is increasingly important in criminal proceedings," said European Commission Vice-President Frans Timmermans.

"We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice."

Digital borders are a growing global issue in an era where big companies operate so-called cloud networks of giant data centres, which mean that an individual's data can reside anywhere.

Technology companies have found themselves torn between protecting consumers' privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that U.S. judges could issue warrants for data held abroad while giving companies an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement.

Where companies find themselves in a conflict-of-law situation because the country where data is stored forbids them from handing it over to a foreign authority, they will be able to challenge the seizure request.

However, such extraterritorial rules are fraught with complexity, legal and privacy experts warn.

In the United States, for example, certain companies are prohibited from disclosing information to foreign governments, while in Europe consumers' data privacy is strictly protected and companies are restricted in how they can transfer data outside the bloc.

"The Commission is proposing dangerous shortcuts to allow national authorities to obtain people's data directly from companies, basically turning them into judicial authorities," said Maryant Fernandez Perez, senior policy adviser at campaign group European Digital Rights.

Ultimately, the Commission hopes to start talks with the United States on a deal to help law enforcement authorities to seize evidence held on each other's territories.

"We always think it's useful to have an EU-U.S. coordinated approach instead of a French-U.S. approach, a Belgian-U.S. approach because that leads to fragmentation," a Commission official said. </s> Law enforcement authorities from European Union member states including Bulgaria, as well as from Canada and the United States launched a joint action on April 25 2018 against the so-called “Islamic State” (IS) propaganda machine in order to severely disrupt their propaganda flow, EU police agency Europol said on April 27.

The takedown operation was coordinated by the European Union Internet Referral Unit (EU IRU) within the European Counter Terrorism Centre (ECTC) at the Europol headquarters.

Led by the Belgian Federal Prosecutor’s Office and with the support of Eurojust, the operation involved authorities from Belgium, Bulgaria, Canada, France, the Netherlands, Romania, the United Kingdom and the US in a co-ordinated effort to hinder IS’s central capability to broadcast terrorist material for an undetermined period of time.

The case started at the end of 2015 when Europol informed all EU member states about the rise of the Amaq News Agency and the technical resilience of the terrorist online infrastructure. Since then law enforcement agencies have, in a continuous joint effort, taken down the web assets of the media outlet, Europol said.

In August 2016, thanks to contributions from EU member states and non-EU countries, a first takedown was launched against Amaq’s mobile application and web infrastructure. This action forced the propagandists to build a more complex and secure infrastructure to prevent further disruption from law enforcement.

In June 2017, a second strike, led by the Spanish Guardia Civil and supported by Europol and the US, targeted part of the news agency’s web assets and infrastructure. The servers seized by the Guardia Civil allowed for the identification of radicalised individuals in more than 100 countries worldwide.

On April 25-26 2018, a simultaneous multinational takedown, coordinated by Europol’s EU IRU and with the support of Eurojust and the Belgian Federal Prosecutor, led to the seizure of digital evidence by law enforcement from Bulgaria (Cybercrime Department in General Directorate Combatting Organised Crime), France (SDAT-SDLC), Romania (Directorate for Countering Organised Criminality – Terrorism Investigation Unit with the support of the Romanian Intelligence Service), and the seizure of IS servers in the Netherlands (Dutch National Police – Internet Referral Unit together with the Belgian Federal Judicial Police – East-Flanders), Canada and the US.

Meanwhile, the United Kingdom (Counter Terrorism Internet Referral Unit) took the lead in the referral process of top-level domain registrars abused by IS.

“With this takedown action, targeting major IS-branded media outlets like Amaq, but also al-Bayan radio, Halumu and Nashir news, IS’s capability to broadcast and publicise terrorist material has been compromised,” Europol said.

Rob Wainwright, Executive Director of Europol, said: “With this ground-breaking operation we have punched a big hole in the capability of IS to spread propaganda online and radicalise young people in Europe. I applaud the determined and innovative work by Europol and its partners to target a major part of the international terrorist threat prevalent in Europe today”.

Initially giving the impression of an independent media outlet providing factual information on IS, Amaq was used in 2016 to claim the attacks in the Levant and all over the world, including the attacks in Paris, Brussels, Barcelona and Berlin, and more recently in Trèbes (France), Europol said.

Amaq News Agency is the main mouthpiece of IS. It was officially endorsed by the terrorist organisation in July 2017 and has since become the primary source of information regarding the remaining activities of IS worldwide, the police agency said.

Since 2015 Amaq News Agency has been launching its own software and has developed highly resilient online infrastructure hosting. As of December 2017, the entire range of IS propaganda is available in at least nine different languages, as well as a wide range of online services, such as mailed newsletters and add-on extensions for the most common browsers.

Law enforcement agencies involved expect that the data retrieved as a result of the takedown will help to identify the administrators behind IS media outlets and potentially radicalised individuals on European soil and beyond.

In the context of the EU Internet Forum, the EU IRU proactively monitors online propaganda activities of the listed jihadi terrorist organisations in the EU on a daily basis, including related websites, servers and applications disseminating IS propaganda.

Commissioner Julian King said: “This shows that by working together we can stamp out the poisonous propaganda Da’esh has used to fuel many of the recent terror attacks in Europe. For too long the internet has been open to terrorists and those who seek to do us harm: those days are coming to an end thanks to this type of co-ordinated global work”. </s> Technology companies could be ordered to release vital electronic data, such as emails and text messages, to law enforcement agencies in as little as six hours under proposed European Union rules aimed at speeding up access to electronic evidence on crimes such as terrorist plots.

Judges would get the right to directly request key data regardless of where it is stored, with a deadline to respond within 10 days, or six hours in case of an emergency, the European Commission said on Tuesday. The proposals are aimed at replacing an unwieldy system that too often slows down investigations due to the difficulties to access this data.

"While law enforcement authorities still work with cumbersome methods, criminals use fast and cutting-edge technology to operate,” EU Justice Commissioner Vera Jourova said in a statement on Tuesday. “We need to equip law enforcement authorities with 21st century methods to tackle crime, just as criminals use 21st century methods to commit crime.”

Police investigations into the terror attacks in Belgium’s capital Brussels just over two years ago connected the main suspect to a cell involved in other European attacks, which the police suspected communicated mainly through email drafts. Under current rules, access to one particular email stored on a Microsoft Corp. server in Ireland would take about a year, by which time data risks being deleted, according to the commission.

“We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice,” Frans Timmermans, first vice-president at the commission said. The new plans would give authorities “unprecedented tools” to access electronic evidence “quickly, efficiently across borders.” </s> The European Union’s digital privacy law, known as the General Data Protection Regulation (GDPR), officially went into effect today. But some websites in the U.S. have decided to block their services entirely rather than adhere to the new regulations. Dozens of American newspapers are currently blocked in Europe and web services like Instapaper have suspended operations in the European Union for the foreseeable future.

First reported by the BBC, news sites owned by media companies like Tronc and Lee Enterprises are now totally dark in European Union countries. Some of those sites include the Los Angeles Times, the New York Daily News, the St. Louis Dispatch, the Chicago Tribune, and the Orlando Sentinel. Gizmodo was able to confirm that the websites were being blocked in Europe by using a VPN service that routed internet traffic through various European countries.

Internet users who visit sites like the L.A. Times receive a notification like the one below, explaining:

Attempting to reach a site like the Arizona Daily Sun from Europe gives you this notice:

The reaction to the blocks in Europe has been mixed, with some people blaming the European Union for enacting a law that they see as too burdensome on companies, while others wondered what these newspapers were doing with everyone’s data that would put them in violation of the GDPR in the first place.

Instapaper, a service that allows you to store newspaper articles in its app, announced earlier this week that it would be ceasing operations in Europe but said that it would “restore access as soon as possible.”

The GDPR was legislation passed in April of 2016 to ensure that internet users had more control over how their information was being used. Companies face enormous fines if they’re not in compliance with the data protection rules that have been laid out, which include providing more information to consumers on how data is being collected on them, and forcing companies to delete old data that’s no longer being used. At its most drastic, the EU’s Information Commissioner’s Office (ICO) has the power to fine large companies up to 4 percent of the company’s global annual turnover after the second offense. For large companies like Google and Amazon that’s in the billions of dollars. Under the new rules, lengthy user license agreements also must be in plain language and easy to understand.

And it’s not just tech companies that must comply with the law. Every organization that handles data on EU citizens, including banks, airlines, and insurance companies, must be in compliance. Today was the deadline for all companies to be in compliance with GDPR, but surveys show that anywhere from 60 to 85 percent of companies say that they’re not ready to be compliant today. It’s unclear how EU regulators will react, but so far they’ve showed no signs of being lenient. The companies did have over two years since the law’s passage to get their acts together.

Mark Zuckerberg, currently embroiled in scandal over Facebook’s mishandling of private user information, told members of European Parliament on Tuesday that his company would be ready to comply with the GDPR by today. But we really won’t know until these companies face some kind of audit. Best of luck with that, EU. Judging from Zuck’s performance earlier this week, Facebook doesn’t care too much about transparency.

Update, 7:55am: NPR appears to be giving Europeans a choice of either still being tracked with cookies and other tracking technologies, or just viewing NPR online in plain text.

Here’s what it looks like when you visit NPR.org from the UK:

And here’s what the website looks like if you opt out:
The European Commission announces plans to force tech companies worldwide that provide services within the European Union to supply data on their users in counterterror investigations.