wk05498-en18

Dieses Dokument ist Teil der Anfrage „working papers dual-use regulation

/ 7
PDF herunterladen
Brussels, 07 May 2018

                                                                     WK 5498/2018 INIT

                                                                     LIMITE

                                                                     ATO
                                                                     CFSP/PESC
                                                                     COMER
                                                                     CONOP
                                                                     ECO
                                                                     UD


                                         WORKING PAPER
              This is a paper intended for a specific community of recipients. Handling and
              further distribution are under the sole responsibility of community members.



INFORMATION
 From:                Finnish Delegation
 To:                  Working Party on Dual-Use Goods
 Subject:             Export Licenses for Mobile Telecommunications Interception Equipment (5A001.f)


Delegations will find attached, for information, an exchange of mails between "Privacy International" and
Finnish authorities.




WK 5498/2018 INIT
LIMITE                                                                                              EN
1

Helsinki, 4 May 2018

Privacy International

Accessnow



Dear Mr. Omanovic, Dear Ms. Krahulcova,


Thank you for your e-mail letter which we received on 24 April 2018 regarding export
licenses for mobile telecommunications interception equipment, category 5A001.f, IMSI
catchers.

I assume that your letter follows from the fact that the Ministry for Foreign Affairs of Finland
has sent Privacy International the complete list of all export licenses for dual-use items
issued in Finland from year 2015 to year 2017. The list included the names of the destination
countries, companies exporting with the license and items exported.

For authorities like my ministry, it is important to be as open as possible. At the same time, it
is essential that the information placed in the public domain is factually correct.



Finnish export licensing of IMSI catchers

In Finland there is currently one company exporting IMSI catchers which you also refer to in
your letter, EXFO Oy. The volumes of IMSI catchers exported from Finland are in real terms
much lower than what one may think on the basis of the number of export licenses. For the
overwhelming majority these licenses are for demonstration purposes only. Finland also
grants licenses for permanent export of IMSI catchers, but we do not disclose information on
which export licenses are only for demonstration and which export licenses are for actually
exporting these items. We need to take into account the level of transparency outside
Finland, as Finnish exporters compete in the same international markets with companies
from other countries and we believe that we already have provided more detailed information
than what is available from other countries which have issued export permits to IMSI
catchers.

IMSI catchers have legitimate uses in identifying terrorists and criminals. In this use they
support many extremely important human rights, such as the right to life of citizens
potentially targeted by terrorists or drug dealers. IMSI catchers are also used in efforts to
save lives by finding for example missing children, missing elderly persons and missing
suicidal persons.

Misuse of IMSI catchers, or any other dual-use items, is unacceptable.

When considering an export license application for IMSI catchers, Finland assesses all the
criteria in the EU Regulation 428/2009 including all the criteria in the Common Position
2008/944/CFSP, including the criterion 2 on human rights.
2

We have reason to believe that on dual-use export denials which were based on
considerations relating to human rights in the time period from year 2014 to year 2016,
despite of its very small size in European terms, Finland made the second most human
rights-based denials in absolute numbers. We cannot elaborate on this as it is not our
information and it is not public information. We are convinced that internationally compared
our policy line against possible human rights violations is very strict and definitely not
permissive.

Finland will assess inter alia the following aspects when considering whether or not to issue
an export license to IMSI catchers: the technical parameters of the IMSI catcher in question
(because the capabilities of different systems vary), considerations relating to the destination
country, whether the announced end-use is legitimate or illegitimate from Finland's viewpoint,
whether the end-user is reliable so that there is no reason to suspect diversion (also in the
sense that the announced use will truly be the only use or is technically the only possible
use) and whether the application is for demonstration only or for permanent export.

There are cases where a license for IMSI catchers has not been issued. For the
overwhelming majority, these cases are not public because the applications have been
withdrawn by the applicants before coming to a decision. This is normal practice in Finland
where in accordance to our legislation we hear the applicant before the final decision – in
cases where the Ministry's assessment is negative the applicants almost always withdraw
instead of continuing the procedure until the end.



Increasing transparency

Export control is by its very nature international action aiming at effective global impact. In
the EU all member states implement the same law, that is the Regulation 428/2009. The
control list annexed to it is updated yearly on the basis of the updates have been made
during the previous year to the control list of the international regimes such as the
Wassenaar Arrangement. Similarly, other participating states of the Wassenaar Arrangement
have their own legislation, which in their countries makes the Wassenaar Arragement control
list and its updates legally binding.

These rules and practices and their implementation, which organizations such as Privacy
International and accessnow rightly try to follow as closely as they can, should be the same
in all countries across the EU and the international regimes.

The first thing is transparency, making the information available, because understanding the
situation comprehensively and deeply enough is the prerequisite for meaningful discussion.

In the relevant EU Council working group, Finland will take up your letter and my reply to it, in
an effort to increase transparency all member states in their licensing to the extent possible
with also security and commercial secrets aspects considered.

Finland already has a high level of transparency and we would welcome increasing the
transparency level also in the EU and in the Wassenaar Arrangement.
3

Verifying the factual correctness of public statements

As information increases due to increasing transparency, it is even more necessary than
before to make checks on the factual correctness of public statements.

A concrete example which we would like you to correct is an article on Pakistan
https://privacyinternational.org/state-privacy/1014/state-surveillance-pakistan on the
webpage of Privacy International. Under the heading "IMSI Catchers" this article includes the
following text: "Finland, too, granted licenses to companies based in Finland to export
surveillance technologies to Pakistan. For instance, the export authority authorized four
export licenses to ABB, an automation technology company, to provide "waveform digitisers
and transient recorders" in Pakistan, which are used to analyse audio and remote sensing
data." The same text can be found from a report published in 2015
https://privacyinternational.org/sites/default/files/2018-
02/PAKISTAN%20REPORT%20HIGH%20RES%2020150721_0.pdf)

According to our information ABB does not produce IMSI catchers and we are not aware that
ABB would export waveform digitisers and transient recorders either, at least as far as the
ABB in Finland is concerned. Furthermore, waveform digitisers and transient recorders are
not IMSI catchers, they are electronic assemblies. They might be seen as having some uses
also as surveillance equipment, but they are very different from IMSI catchers and less
sensitive items from the human rights viewpoint. Finally, at least in our records at hand (16
January 2013 to date) we are not able to find any IMSI catcher exports from Finland to
Pakistan, nor are we able to find any waveform digitisers / transient recorders exports to
Pakistan, and also ABB cannot find that in their records. We would like to request that you
reconsider this passage relating to Finland, ABB, IMSI-catchers and Pakistan on your
website, in your earlier report and in other texts where it may have been published.



Follow-up

Finland shares with Privacy International and accessnow the objectives of promoting and
protecting human rights. We also stress the need for sufficient –and factually correct – public
information.

Finland will raise the importance of increasing transparency in the relevant EU Council
working group.



Yours sincerely,



Timo Soini
Minister for Foreign Affairs of Finland
4

Timo Soini
Minister for Foreign Affairs
Ministry for Foreign Affairs
Office of the Minister for Foreign Affairs
PO Box 412
00023 GOVERNMENT
FINLAND

umi@formin.fi

RE: Export Licenses for Mobile Telecommunications Interception Equipment (5A001.f)

Dear Timo Soini

We are writing to request a full re-assessment of all export licenses for telecommunications
interception equipment with appropriate human rights considerations and detailed
information.

In 2012, the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-
Use Goods and Technologies (the “WA”) revised its List of Dual Use Goods and Technologies
(the “WA Dual Use List”) to include a category for mobile telecommunications interception
equipment, which includes equipment popularly known as “IMSI catchers” and other
equipment used to intercept satellite phone communications.1 Regulation (EC) No 428/2009
of 5 May 2009 (the “EU Dual Use Regulation”) incorporated these items into the EU Dual
Use List in December 2014 under category 5A001.f.2

IMSI catchers can intercept and extract communications, subscriber identifiers and other
data from mobile phones. An IMSI catcher presents itself as a base station within the mobile
network, causing all mobile phones operating within its vicinity to connect to it. Once
connected, the IMSI Catcher can gather data about the phone and monitor its operation
(such as the voice calls taking place, the messages being sent and the location of the phone).

We are concerned that such equipment undermines the right to privacy by gathering
information on individuals on an un-targeted basis. It can also undermine the rights to
freedom of expression, assembly and association by, for example, allowing security
authorities to identify individuals at protests or other gatherings. IMSI Catchers also present



1
 http://www.wassenaar.org/wp-content/uploads/2015/06/Previous/2012_OK/WA-LIST%20%2812%29%201.pdf
2
 http://trade.ec.europa.eu/doclib/docs/2015/january/tradoc_152996.pdf;
http://trade.ec.europa.eu/doclib/docs/2014/october/tradoc_152854.pdf




                                           PI is a registered charity in England and Wales No 1147471   1
5

a security risk for governments worldwide by allowing users to intercept and decrypt
communications of their citizens and diplomatic staff.

According to export licensing data provided by the Unit for Export Control, between 2015
and 2017, 85 licenses for category 5A001.f have been issued to EXFO Oy, a large
manufacturer of IT products including IMSI Catchers. EXFO’s sales brochures specify their
IMSI Catchers are able to intercept calls, SMS messages, and carry out decryption.3

Granted licenses include a license to Mexico in January 2016 for “cracking unit(HW) enabling
interception of the GSM calls”. Recently it has been widely reported that Mexican security
authorities have been using commercially available surveillance technology to target
prominent lawyers, journalists, and anti-corruption activists.4

A licence was also granted to Macedonia, where in 2015 it was reported that some 20,000
people were unlawfully wiretapped by the security forces for a period of several years. A
September 2017 assessment by rule of law experts working for the European Commission
found that the “urgent measures to prevent illegal wiretapping have not been addressed.”5

A license was also granted for the UAE, where award-winning human rights defender and
democracy activist Ahmed Mansoor has been targeted multiple times by surveillance
systems available to government authorities on the open market. He has been now been
held for over a year in an unknown location in solitary confinement without access to a
lawyer on charges of ‘cybercrimes’.6

Other destinations for licenses granted for phone interception equipment include the
Philippines, Kuwait, Columbia, Brasil, Morocco, Indonesia, Oman, Serbia, Bosnia,
Netherlands Antilles, Qatar, Malaysia, Jordan, South Korea, Montenegro, Lebanon, Kosovo,
Tunisia, and Albania.

We kindly request that you provide an answer to the following questions:

    •   Was an assessment conducted against Criteria 2 of the EU Common Position
        2008/944/CFSP?
    •   What information was obtained and considered regarding the end-users’ roles in the
        recipient countries, and if the end-users have been involved in internal repression or
        serious violations of human rights?

3
  https://spytechexports.com/document-exfo-2018-brochure-2ef2e35770c9
4
  https://www.nytimes.com/2017/06/19/world/americas/mexico-spyware-anticrime.html
5
  https://ec.europa.eu/neighbourhood-
enlargement/sites/near/files/2017.09.14_seg_report_on_systemic_rol_issues_for_publication.pdf
6
  https://www.hrw.org/news/2018/04/09/uae-one-year-award-winning-human-rights-defender-
ahmed-mansoors-whereabouts-remain




                                       PI is a registered charity in England and Wales No 1147471   2
6

•   What information was obtained and considered regarding the commitment of the
       recipient countries’ Governments and end-users to respect and improve human
       rights and to hold human rights violators accountable?
   •   What information was obtained and considered regarding whether the recipient
       countries have agreed to external or other independent monitoring and/or
       investigations of alleged human rights abuses, and if so, how they have reacted
       to/implemented any findings?
   •   What information was obtained and considered about the lawfulness of internet
       surveillance in all end-user countries and its compliance with international human
       rights law?
   •   Given the information available, does the Foreign Ministry consider there to be a
       clear risk that the export of telecommunications interception equipment to any of
       the destination countries?

In addition, we ask that the Ministry now conduct a full re-assessment of all export licenses
for telecommunications interception equipment, including an assessment of the human
rights risks and the sufficiency of the legal framework in the destination country and its
compliance with international human rights law.

We ask that where the export presents a risk to human rights, or if the legal framework
governing surveillance in the destination country is not sufficient, that the export license
now be revoked.

To assist with your assessment, you may reference The International Principles on the
Application of Human Rights to Communications Surveillance; a set of principles developed
by civil society and technology experts which provide a framework for assessing human
rights obligations and duties when conducting communications surveillance. They are
available at https://necessaryandproportionate.org/principles

We also ask that you confirm whether you believe that the human rights assessment
procedure provided by the EU Dual Use regulation 428/2009 can be updated to provide
better clarity, a stipulation that the legal framework governing surveillance be considered,
greater human rights protections, and increased transparency reporting measures.

We thank you for your attention in this matter and look forward to a prompt response.

Yours sincerely,




                                       PI is a registered charity in England and Wales No 1147471   3
7