Foreign Keys: Travel Surveillance

00:00:08.10
[Loveletter by Sepia plays]

Gus
Welcome to The Tech Pill, a podcast that looks at how technology is reshaping our lives every day and exploring the different ways that companies and governments use tech to increase their power. My name is Gus Hosein and I'm the Executive Director at Privacy International.

00:00:21.58
Caitlin
And I'm Caitlin and I'm PI's Campaigns Coordinator. Hi!

Gus
This week, we're talking about travel.

00:00:29.27
Gus
I don't know if it's the same for you wherever you're listening, but in London, as we hit July, everybody starts imagining being elsewhere. And with the World Cup going on, many people around the world are traveling to see the World Cup, to get locked out of seeing the World Cup. But also it's just in the Northern Hemisphere, it's summer holidays coming soon. So we thought it would be interesting to explore what is travel going to be like this summer.

00:01:01.98
Gus
Whether you're heading to U.S., Canada, and Mexico, like I am later this summer, or you're heading to Europe to avoid going to U.S., Canada, and Mexico during the World Cup. And I'm also heading to Europe this summer. Or you're flying elsewhere to avoid both of those geographic zones, but then you have to worry about the fact that your airplane's probably avoiding ongoing conflict zones and making travel times even worse. So travel this summer is not going to be simple.

00:01:30.39
Gus
So we thought we'd explore it with you.

Caitlin
Yes, or you can do what I'm doing, which is driving to Devon. That's such a wise idea. But though, Devon's like far away. I mean, it depends. You're an American...

Gus
Yeah, true

Caitlin
...well kind of, so your version of far away is different from mine. So for me, it's a really long drive. It's worth noting for a future podcast that car travel will not always be unsurveiled and, you know, the easy way around some of these problems. But that's a different podcast for a different time. This podcast is air travel.

00:01:58.58
Caitlin
And this podcast is the World Cup.

Gus
International travel.

Caitlin
Exactly. International travel. That's a better, yeah. International travel. Yeah. And we thought we'd start with the World Cup because, you know, it's the big event that people are traveling for that's, to say it on everybody's lips, but I suppose it's not. Based in the UK, it's huge. Presumably other places less so, but still, World Cup travel. And in recent weeks, there have been quite a few stories about how World Cup travel is not necessarily going that well.

00:02:42.46
Caitlin
It's kind of lucky in some respects that the World Cup is split between Canada, the US and Mexico, because at least Canada and Mexico aren't causing too many problems.

Gus
Yeah, yeah.

00:02:52.84
Gus
I'm going to try to avoid sounding like an old man many times, but like the US sucks as a border, without a doubt. The US has the worst border. when it comes to surveillance and oppressive tactics and whatnot. But what the US government's been doing since 9-11 has been forcing its two other land borders, being Mexico and Canada, to make their policies just as annoying.

00:03:16.22
Gus
And I can't say the same thing of the Mexican government, but I can certainly say of successive Canadian governments, their responses to US bullying on creating stronger border for Canada has been to be "okay". They've been so freaking compliant. And so they have no problem ramping up their border surveillance and oppressive border practices, but they're not yet as sh**. Sorry, I shouldn't swear, but I do swear a lot when it comes to border and travel policy. It's it's it's one of the first policy domains I looked into after comms surveillance in the 1990s. So I am such an old fart.

00:03:55.35
Gus
Can I use the word fart? I don't know.

Caitlin
I think you can use the word fart. I do not think fart is a swear.

Gus
Okay

Caitlin
If it was, we'd have issues with the president's name.

Gus
Yeah Yeah, that's right. So the US already has like this practice of collecting data on travelers even before they show up, but that's either in the form of asking for a visa or when you have to get some pre-clearance through the ETA, the electronic travel authorization, which Canada has as well, of course, because it wanted to ape the Americans. And then when when you show up, you have the indignity of landing in the US where you get fingerprinted and that data is kept for a hundred years.

00:04:33.37
Gus
And that was all like post 9-11 stuff, you know? So as much as people think things have been getting worse in America in the last few years, and certainly is going to get a hell of a lot worse with Trump administration policies, already traveling to the US is just supremely unpleasant. And I can say that as a citizen too.

Caitlin
Yeah, 100%. And PI, like, we travel a lot. We're an international organisation, we travel. And we have travel security policies to try and keep information and staff safe as they cross borders. And, you know, there are different, almost levels that travel security policy, depending on the border that you're crossing. and The US has always been one of the borders we've been absolutely ,clear and the security policy has been absolutely clear, is one of the higher risk borders.

00:05:19.16
Caitlin
As such, the steps that we take when we're crossing the US border are some of the most stringent of the steps that we take crossing any border in the world. and so you know Everything that we do when crossing that border is set up such that if you're pulled aside into a you know small dark room by border control, you can say,

00:05:36.82
Caitlin
yes, by all means to every single question they ask. right They say, can you unlock your device? And you go, yes, by all means, because there's nothing on it. We're going to take your device. Yes, by all means, there's nothing on it. And so every single travel security step that we take is predicated on the basis that the US border is a high risk border for surveillance, for data, for privacy.

Gus
It ranks up there with Israel and China for us, where basically if you're traveling those countries, you're not taking anything with you because they're going to take it from you. And I've had that experience, unfortunately, with Israel. But yeah, the US, just like last year, the data was that the Customs and Border Police, I think they stopped over 55,000 people for searches of the electronic devices.

00:06:22.51
Gus
And, what's really interesting, if you are traveling to the US and you are concerned about this, if you do a search about this issue, you will find a lot of outlets, news outlets predominantly with guides for you on what you can do to prepare for travel to the US. And I go back to what Caitlin just said: I don't like those guides because they still presume that you have a level of autonomy when you're at the border. And generally, when you're at the border and if you're not a citizen, you have no rights.

00:06:53.08
Gus
And so the answer should generally be, yes, sir or ma'am, I will comply because otherwise you're going to have a hell of a load of pain coming at you.

Caitlin
And it's worth noting that even citizens in the US, you can't be barred and returned from entering, right? like You're a US citizen, you're allowed home, but outside of that, you don't have many more rights. like We might have exactly the same experience, but that's the only real distinguishing factor, which is their ability to bounce you back to where you came from is much lower.

Gus
After they've detained you for an extended period of time.

Caitlin
Exactly. They can still detain you. They can still arrest you. They can still search your devices. They can still take your devices. They can still do a huge amount of stuff to you. It's just literally that very distinct, are you getting on a flight back to where you came from or are you staying? And staying could mean in prison or detained or any number of things. It's just that.

00:07:47.67
Caitlin
You're getting sent back to your kind of-

Gus
Origin.

Caitlin
Yes, origin. That's what I'm looking for.

Gus
But like, and of course, if you're listening, you're thinking, well, look, what are the odds of getting stopped at the border and having your phone search like that happens? I think the percentage is like 0.01% of the travelers to the United States have this problem.

00:08:06.04
Gus
And that's where we get into what the Trump administration has been pushing, which is they want it so that in the future, and it's unclear to me if they were able to accelerate this in time for the world cup and for the summer's travel. but they want it so that every traveler to the U.S. has to submit ahead of time your social media accounts, your email accounts, your phone numbers, your business phone number, your family's email account, social media account, their phone numbers, your work email, every form of identifier that can allow them to, whether it's search a database or search through social media, and you can imagine if you're traveling as a family, they're going to search through your kid's social media account in a way that you haven't. You're going to be judged as a family on your way to a game or to Disneyland or whatever the hell you're doing based on your kid's social media account. And welcome to the future brought to you by the Trump administration. And this was all based on a consultation for changes to the Federal Register that they ran at the end of last year. And in that, they also said it was just the throwaway line that they want DNA as well. So that's the world that the Trump administration is building for future borders.

00:09:32.38
Gus
What we've seen already around the World Cup is there was a lot of news around the first referee to participate in the World Cup from Somalia was stopped at the border and sent home and was not allowed to be the first referee and in in World Cup history for Somalia.

Caitlin
And I mean, that specific instance, obviously, you think, because it only happened with the World Cup, but Trump has been targeting people from Somalia since at least the beginning of this administration. I don't think from the beginning of last administration, but for some reason, it's Somali specific that a lot of Somali people have been targeted by Trump's border policies. I don't know why. It's quite a specific form of racism, Somalia, but it has been happening pretty persistently.

Gus
To be fair, the BBC, when we were doing research on that specific case, also flagged a case of a person from Scotland who, as pre-approval, was revoked.

00:10:27.49
Caitlin
Yes. And so he had gotten the approval in good time, he'd been very responsible. And then it having been approved, the status then changed to pending. And then basically the day think he was going to fly, was changed to denied. So, despite having received approval sometime in that period of time, they'd gone actually and changed their mind despite the initial assessment, I guess. Which means had flown from Australia, where he lived, to Scotland, where his family was to visit his family, so he could fly with his brother to the World Cup. Now, instead, he has to fly back to Australia and presumably eat the cost of the flight to Florida, which is a lot of money.

Gus
Yeah, there's going to some awkward family conversation because their brother continued. Are they still going to split the hotel costs and everything like that?

00:11:13.21
Gus
So if you are fortunate enough to travel to the U.S. for the World Cup and you land and you get through with or without your devices, With or without your DNA being taken, um you also have to deal with the fact that you show up at a stadium and there's vast amounts of surveillance at these stadiums now. Mass surveillance is being deployed more and more at sporting events. And on the day that we were recording this, the UN special rapporteur on freedom of protest

00:11:44.27
Gus
issued a statement about how alarmed she was about the expanding use of mass surveillance and immigration enforcement at football matches. And she timed it for the start of the World Cup saying, look, it's really disappointing that you know this is supposed to be a time of celebration. Instead, people have to be worried about being rounded up by just attending these celebratory moments.

Cailtin
Yes. And one of our colleagues, Clara, has put together a ton of work on increasing uses of surveillance technologies, particularly facial recognition of football matches kind of generally throughout the footballing ecosystem, not just the World Cup, which is available on our website on all good websites, so just ours, and we'll put the link in the description because it's quite interesting just seeing the expansion of these kind of surveillance technologies into community events.

00:12:29.40
Gus
Yeah, like again, I'm gonna sound like an old fart, and again we agree that I could use the word fart, but I remember working on this issue back in 2000, so right before 9/11, and right before two big stories that are related to this is that first in light of a plane that had taken off in America had blown up that was not terrorist related, the Clinton administration decided to push forward with a computer assisted passenger profiling system that would take passenger data and decide who's a terrorist and who isn't.

00:13:05.94
Gus
And they were facing a lot of flack for trying to introduce a profiling system. was literally called a profiling system. And around the same time, Tampa Bay, who had been about to host the Super Bowl, had deployed facial recognition technology. The police in Tampa Bay had deployed facial recognition technology. And it had become quite embarrassing because the mayor of Tampa Bay was going around selling this technology to other mayors all across the country.

00:13:32.82
Gus
And it's only afterwards we found out that the police actually shut off the system because there's so many errors that were being flagged by the system that it ended up being pointless. But then, you know, a few months later, 9/11 happens and both those policies go into overdrive.

Caitlin
Which brings us on neatly to the next topic, which is the new EU travel profiling system, or the many, many EU systems, some of which are new and some of which are not new, which are integrated in increasingly complicated ways.

[Music break]

00:14:15.54
Caitlin
Right, so I'm gonna try and get through this without using any acronyms.

Gus
Wow.

Caitlin
I know, because I was writing a list of all the acronyms that are involved in this story of these series of systems, and it is long. And so I'll include the list of acronyms, because don't think we're gonna manage it in the description. and I'll probably take off some of my really shady notes, but there are one, two, three, four, five, six, seven, eight, nine, 10 key acronyms. Actually, we could probably do this in acronym form where we only use acronyms, but that would be harsh.

00:14:47.67
Caitlin So if you're looking to travel to the European Union, or no, to be specific, if you're looking to travel to the Schengen area, which is largely European Union countries, but not entirely, then look out because they have been implementing some new border systems, which are causing abject chaos. But I think actually we should start with what happened to you, Gus.

Gus
Oh, yeah. So we've been warned for years now that Europe wanted to start its fingerprinting biometric collection system of all non-EU travelers to the Schengen area, as Caitlin perfectly drew that distinction. And it kept on getting delayed. It was supposed to happen for the French Olympics, and then it got delayed. And they just so happened to turn the switch formally on about five days before I had to travel to Portugal for a meeting.

00:15:44.76
Gus
And like I've been in fear of this system going on, mostly because I knew it would be just a collect... like ah an absolute mess. And so lo and behold, I was not let down. We land at Lisbon Airport. And there was just queues upon queues upon queues. And the travelers are bewildered as to where we're supposed to go and what we're supposed to do. And then we go in front of a computer to self-register and all of that. And the computer just doesn't even recognize the fact that it's alive. And so it's like we're trying to interface with it. And so then we look to the staff and so often the staff just like nod their head it with a smile. Like, you know, it's just, they're so used to it not working. They just point you to another queue. So you go into the that other queue and it's just, there's a human being who who just processed your passport like the old days and you continue on.

00:16:35.93
Gus
And that was, you know, mildly amusing. And we thought we we could talk about it in a podcast someday, but not urgently. It was the departure that was the cluster fart. Let's call it that. ah Where leaving Lisbon, we got to the airport four and a half hours early and getting through, you know, security was the easy bit. Once you get through security, you see this wall of people. And I, I've never seen so many people outside of a sporting event.

00:17:08.65
Gus
I would say without exaggeration, at least 5,000 people on a queue. Because if you think about it, all the airplanes each have seats of, to say, 300 seats. And there must have been at least a half dozen flights the US within the next four hours. And of course, all the other flights outside the Schengen area and inside the Schengen area. So you had all these people queuing and nobody had any idea what the hell was going on. You're queuing and queuing, and it it was about two hours of queuing. Then you finally get to where these gates are these automated gates that are supposed to take your your fingerprints and re-scan you to help in order to help you out. But by the time we waited for that entire time, and there was so much chaos because people were dying to get to their flights, the airport officials and the border officials decided to say, okay, you know what? Again, let's just put you through to a person at a desk. But this time, the person at the desk knew that the pressures were so high, they didn't even look at the passport. They just noticed that there was a passport, opened it to a page, closed it, and just let everybody through. Absolute chaos. And so they could have done that two hours before, then saved us all two hours. But it was just, it was ridiculous. It was security theater. and completely foreseeable. So sorry, i just got so it's a foreseeability part that just drives me nuts.

Caitlin
Wow. So this is the end point of this system. This is the like largely public facing part, which is called the entry and exit system. And the entry and exit system demands four fingerprints and a photograph taken upon arrival at the border for inclusion in the entry exit system database.

00:18:45.21
Cailtin
So people who had to apply for a visa, which is still most of the world when it comes to the Schengen area, have already had 10 fingerprints and a photo like as part of the visa application process. The new part is non-EU citizens who don't need a visa and now need a travel authorisation. And so the new aspect of this is those people are now being asked to provide biometrics.

00:19:09.24
Caitlin
The entry exit system, I forgot I wasn't using acronyms. The entry exit system, airlines have been calling for its suspension because the wait times are just crazy. And they've been exacerbating existing on wait times. And they're just like, when we can't cope with this, we need to be able to suspend it. And in theory, when you leave the Schengen area, anytime you cross that kind of external border, the same checks should take place as when you enter.

00:19:31.42
Caitlin
Now, this is one of a load of different databases that have been introduced in the kind of, a in the hope, all under the heading of like interoperability. So the idea is there are there's loads more information in the system and that information can talk to all the other information to achieve, you know, X purpose. And so there are all these new databases and new travel procedures.

00:19:53.62
Caitlin
The information that's stored either in the visa information system, which is the visas, or the ETIAS, which is the European Travel Information Authorization System, which is for people who need the travel authorization because they don't need a visa. They both now feed into something called the Common Identity Repository.

00:20:12.25
Caitlin
So you apply for your visa or your travel authorization. You have to give up you know a certain amount of information, more if you need a visa, less if you need the travel authorization. And then identity information from both of those systems get passed up to this new system called the Common Identity Repository, which only includes non-EU citizens and it is really, really sketchy. So it's not all the information you ever give, like it's not purpose for travel, it's not, you know, any of that kind of thing. Instead, it's like passport information, name, it's anything identity specific rather than individual journey specific. And the intention with that system is once you cross the border and you're in the country or you know persistently onwards because the information is retained, for example, police can check who you are. If you have a really pretty severe accident, they can check who your body is. They can do all sorts of things in a country, right? l

00:21:10.08
Caitlin
Functionally, they can stop you and find out who you are or what this information that has been gathered about you is. It also links to an automated procedure which tries to detect false identities. This also has its own acronym. It's the MID, which is the Multiple Identity Detector, which attempts to look at loads of different factors like your biometrics and see if they're associated with their own accounts. And also runs your information through another database, which is the Interpol's Stolen and Lost Travel Documents Database, or the SLTED, which double checks if your passport's been pinged as, for example, missing or stolen.

00:21:48.82
Caitlin
All of these different aspects have huge problems. But it's like this big collective set of databases, including two other ones I haven't mentioned yet, which is the Schengen Information System, which is an EU database for police, border control and others to be able to check if people are wanted by police, subject to for an entry ban, which is checked every time you cross that external Schengen border, even if you're a EU citizen, but everyone should get, in theory, run through Schengen Information System or the SIS. And then the other, actually the other two important databases to know about is the European Criminal Records Information System for Third Country Nationals, which is a basically a database that records non-EU citizens who've been convicted in EU member states of crimes. and Eurodac, which is a database of asylum seekers, and they're trying to add undocumented migrants to this system. So that's supposed to keep track of all of that.

00:22:41.59
Caitlin
So that's all of the different databases, if you include the Entry - Exit system, which is itself a database. So if you can keep all those different databases straight, there are really quite significant problems with a load of them. They're problems that in 2010, the European Commission highlighted. The European Commission said, single overarching EU information system with multiple purposes would deliver the highest degree of information sharing, but would also be a gross and illegitimate restriction of individuals' right to privacy and data protection. Which is true!

Gus
Which is the good old 2010s. We were all so naive and hopeful.

Caitlin
The 2010s European Commission were like, yeah, this seems shady. The 2025-2026 European Commission seems, this seems great. Even to the point that Sofrentex, who we actually talked to you about in the last episode we did with Bill Goodwin, who are doing shady data transfers to Europol. Even Frontex went, hmm, this seems shady. There's no data protection impact assessment for the new European travel information and authorization system, the ETIAS. And like there's a huge amount of legal uncertainty because the European Commission was supposed to issue legal guidance in 2024, but they have not done so. And our friends at Statewatch asked the European Commission, like is there a reason that you you haven't produced this guidance? And the European Commission did not respond.

Gus
Oh man.

00:24:07.83
Caitlin
Yes, so...In theory, Frontex operate the European Travel Information Authorization System, but in practice, even they are like, we think this system is sketchy. Which is true, because so there are inadequate safeguards for discrimination, there are inadequate safeguards for purpose limitation, which is to say, the data is not being collected for one purpose, it's being collected and then potentially used for a whole range of purposes. There's no specific threshold for police access. So if you're the police and you want to like take a look at the database to which you have access to, there's no specific safeguard or threshold that says you're only allowed to do it for this kind of level of crime or suspicion or anything like that. There's just, you have limited access to your data protection rights. So normally you have a right to correct systems information where it's wrong, but it's incredibly hard to do that here because it's all over the place and you need to know therefore where it is and where it's wrong.

00:25:03.48
Caitlin
Even understanding it is quite difficult and that limits you access your access to data protection rights. So it's all of these kinds of things to the point that the EU Fundamental Rights Agency, when commenting on the initial proposal for the European Travel Information Authorization System, said that there's limited research available on the feasibility of using risk indicators without engaging in discriminatory profiling, and that the system should only be introduced if a test phase demonstrates the necessity and proportionality of doing so. This is something I've realized I've forgotten to mention, which is going to make everything more confusing. So the intention of these systems, right, and the interplay between them is to run automated checks when you apply for your travel authorization or your visa against a whole range of other systems, both European and international, to see if you could be a problem. And then where those systems like throw up red flags, a human is supposed to then go in and double check them.

00:25:58.04
Caitlin
The problem is that all of the systems that it integrates with or asks questions of aren't necessarily good. They're filled with inadequate data. Like the data is rubbish. It's not good. Previous studies have found huge quality problems with all large scale EU databases. and particularly the visa information system where biometrics are attached to the wrong files, significant amounts of inaccurate data are stored. And so there are all these quality problems, right? Which if you start doing automated checks, represent huge risk for the people being checked because there's no guarantee the information being surfaced is actually about them.

00:26:37.82
Caitlin
There's inadequate protections re things like in particular, and the one that raised particular concerns of Statewatch is Interpol's stolen and lost travel documents database. And so the intention, like when you apply for these things is to say, hey, has someone flagged that their passport's been nicked and this person is using that person's passport is the intention.

00:26:57.72
Caitlin
In practice, different governments have in the past flagged people's documents as lost or stolen when in fact, they just don't like that person.

Gus
Oh man.

Caitlin
All the State Watch examples are Turkish examples. So one journalist was removed from a flight back in 2017, so it's been going a while, from Brussels to New York after the Turkish authorities issued false notification in that database. Another professional basketball player in the US narrowly avoided arrest in Indonesia after the Turkish government also filed a false report in the lost documents database, and then was detained in fact at an airport in Romania due to this false report. And so the like requirements on national governments in terms of what they're allowed to add and review in these databases are poor because they don't prevent them from like flagging people who aren't problems. There's an inadequate amount of resourcing for the data protection authorities who supposed to be overseeing the new system. Basically, it's adding a ton of extra work to national data protection authorities, and we've had persistent issues with national data protection authorities having the ability to do their own jobs because they're overworked, overloaded, they don't the resourcing, don't have the staff, that have the money. And there are huge problems because it's a huge volume of data that is being stored in like six different databases minimum and is checking further databases outside of those databases. And like policing forces, both national and at the EU level, already have huge problems with the volume of data that they have and their ability to process it and use it. Which is why in some respects you keep seeing incidents that have happened by people who are already on police's databases.

00:28:35.00
Caitlin
Police knowing about someone hasn't necessarily led to the prevention of serious crime. And the volume of data that they have sometimes obscures actual concerns because there's just too much of it to get to or to look at or to engage with.

Gus
And so you're describing that there problems with the fact that there's too much information and these disparate sources of information, untrusted sources such as the Turkish government wrongfully flagging people. But then there's also the back end side where... didn't Statewatch find that the American government's trying to get access to this data as well? There's like a data sharing agreement that's being considered?

Caitlin
Yeah, I think the US wanted basically an exemption.

00:29:13.18
Caitlin
right So they wanted their own staff to not have to engage with the digital border system. So they to get preferential treatment. So diplomatic, military and other personnel wouldn't have to get fingerprinted or facially scanned. And the Council of Europe provided guidance on how to be flexible. And then separately... they were trying to negotiate direct access to the biometric data being collected. Or they think they still maybe are. In 2025, EU ministers agreed to launch negotiations on that agreement, which would give US border agencies access to that personal data. And then vice versa. So the EU border people would get access to the US databases, which like if you had data protection problems before about data sharing, then it heading off to the US makes it even worse.

Gus
But ironically, if you say no to the US in the same way if you say no to the United Kingdom, you should probably count on the fact they're going to hack in anyways.

Caitlin
Yeah, that's also not impossible.

Gus
Yeah, that's yeah generally our finding when it comes to these governments. Yeah.

Caitlin
But it's worth noting, some of these systems been around a while, right? So 2016, a piece of legislation called the Passenger Name Record Directive, or PNR Directive, you'll see it sometimes written out, but we're not using acronyms. So the Passenger Name Record Directive was the first automated profiling system for the EU, which... like is still being challenged in court. So EpiCenter Works, who were an organization who we're friends with based in Austria, and Gesellschaft für Freiheit. No, damn. Gesellschaft für Freiheitsrechte.

Gus
I'm i impressed by that, Caitlin. I'm also impressed you didn't jump immediately to the anglicized version of that, which is the civil rights association based in Germany.

00:31:04.74
Caitlin
I always think any good reason to try and test my GCSE level German.

Gus
Nice

Caitlin
And they've had some victories, right? And some of the victories came in like 2022, 2020. So it's been going a long time, but it includes reducing the retention period, for example. And as far as I know, it's ongoing. So like the challenges and litigation to these rules can take like forever. and won't necessarily lead to them being undone. And there are challenges to the new data retention system, particularly in Belgium by a Belgian NGO called La Ligue des Droits Humains.

00:31:38.94
Caitlin
ah My French is, if anything, if you can believe it, worse than my German.

Gus
You did a good job.

Caitlin
But they are challenging the Belgian system because their definition of a risk to security, which allows them to run all these searches and defines the pings and stuff, includes threats to public order, internal security, and or the international relations of one member state, which they say is crazy, too broad, and it seriously challenges the data protection principle of purpose limitation, which is to say that...

Gus
okay okay

Caitlin
...when you collect data, it should be specific for a specific defined purpose.

00:32:12.28
Gus
Sorry, you're just triggering me. ah So, okay, let me let me old fart this this a little bit. So after 9-11, the US government, like they were ready with a whole suite of demands. So like October 2001, the Bush administration sends letters to governments around the world saying, these are the ways you can help us fight terrorism after this horrible thing happened. And so one of the first responses of the Bush administration was to ask governments around the world to water down their privacy laws, including asking the EU to do that. And they then also said, we want travelers data from all airlines, these passenger name records, and we want to accumulate it in a system. And we're going to do as we see fit. And at PI, and we were working with the American Civil Liberties Union at the time, we knew what it meant for this data to end up in the system because we knew about the Clinton administration's idea of doing passenger, automated passenger profiling.

00:33:07.56
Gus
So we fought this and we worked with the EU. The EU didn't like this. and EU airlines didn't like this. They said, hey, in Europe, we have privacy laws. We're not allowed to do these types of things. We protect the rights of our citizens. And for years, the European Parliament did a phenomenal job of pushing back against the Bush administration's huge appeal or data grab. Until at some point, and I think it's pretty much motivated by the British government, who were always keen to participate with the Americans in these things, the European Parliament and the European Union realized, huh, why why do the Americans want this data?

00:33:43.83
Gus
Maybe there's some fun to be had with passenger records. And so it was around 2010, 2011, when the EU switched gears and said, hey, we're going to build the exact same systems. And that's when I just I threw all my toys out of the pram. And I stopped working on European Union policy for a good number of years. So I thought, what's the point? What's the point when you know they pretend they're all principled and then they switch gears at a drop of a hat and say, ah, but we can do the same thing.

00:34:13.91
Caitlin
So there are two interesting tidbits that I picked up when i was looking into this. One was from Gesellschaft für Freiheitserechte, who flagged that one eu member state already considers it suspicious if someone travels a long distance with too little luggage.

00:34:28.50
Caitlin
Which if anyone's ever been, well, I wasn't one of these students, I was very jealous of everyone else going on a gap year. But if you've ever seen like kids going off on gap years with their big backpacks and nothing else, like, yeah, they don't have a lot of luggage.

00:34:41.59
Caitlin
But also the PNR, no, no acronyms,

Gus and Caitlin
the passenger name record

Caitlin
includes your in-flight meal choice. And what information can someone get from your in fine meal choice that seems really innocuous? Except, of course, quite a lot because they can get information, you know, which again seems fairly innocuous. Are you vegan? Are you vegetarian? Do you eat halal? Do you eat kosher? And those things obviously can then lead to discrimination and targeting on the basis of religion.

Gus
Yeah, and don't forget, it's also health information. Yes. Because if you ask for a low salt.

Caitlin
Yes, it is health information.

Gus
You know, and under law, data protection law, European law, these are sensitive characteristics. Yeah. These are sensitive personal information....

Caitlin
Functionally being collected by proxy

Gus
And it is not to be processed.

Caitlin
eah. Exactly. And it's something you see not infrequently. So we've looked in school context, EdTech stuff, but you look at schools that implement external catering systems and they go, well, it's not sensitive data. And it's like, well, if you're telling an external party who eats kosher, who eats halal, who has medical conditions, yes, it is sensitive data. It just feels like it shouldn't be because it's food. And for some people, yeah, food is not sensitive. And for some people, it's hugely sensitive. And so that I read and went, mmm interesting.

00:35:56.66
Caitlin
There are other issues you'll never guess. So one is what Statewatch describes as pre-crime watch lists. Yes. So already, and this is before the new ETIAS, European Travel Information Authorization System, but the Schengen Information System, which is again, the database that should in theory get checked on entry and exit of anyone entering or leaving Schengen, including like Schengen citizens. It contained alerts on over 126,000 people for different kinds of checks. So there was a little flag on your record that you should be pulled aside for either discrete or specific checks. And this was in 2019. Like the number is from 2019. And so if you were wanted for discrete checks, you would get questioned as you handed your passport over you know, by the man in the little booth, you would get additional information asked. And the idea or was it'd be fairly subtle. You wouldn't know that the flag was there or the specific checks of where you get pulled into back room and someone asks you a lot more questions, a lot more detail, and it's a lot less subtle. But the new system creates new lists, including people who are suspected of maybe in the future, who knows but we think possibly could take part in terrorism or other serious crimes.

00:37:07.32
Caitlin
Which, again, how much information is required to make that determination? how do you challenge that determination? Because you probably will never know that it's there. How do you guarantee that it's accurate. You can't because it's on the basis of crimes you haven't committed, or you've made no attempt to try and get involved in committing because most of the things that that would include would include crimes. So there are all these kind of things that people are trying to make data do to prevent hypothetical crimes or hypothetical problems that are going to cause problems for people now who are trying to travel for any number of reasons, whether it's family holiday, you know visiting relatives, funerals, weddings, you know all the reasons that people travel.

00:37:50.02
Caitlin
There's also a long history of really weird visa requirements, which this is something I thought was really interesting so I didn't know, but apparently it was released by WikiLeaks in 2004. So the fact that I didn't know it doesn't mean it hasn't been around a while. But some nationalities, when they reply for a visa for entry into the Schengen area, require ah prior consultation. And these apparently, to quote, generally follow colonial patterns. For instance, before any member state issues a visa to an Algerian citizen, France must be given the name of the applicant.

Gus
Oh, God.

Caitlin
And France can refuse to allow the partner member state to issue the visa.

Gus
No.

00:38:26.71
Caitlin
Algeria being a former French colony. No. Yes. Which is, again, it's been around 22 years since this cable was released by WikiLeaks, but that is astonishingly bizarre information. And apparently they do largely follow colonial patterns.

Gus
And so if you know the history of surveillance and you know the history of, say, biometric surveillance or databases generally or pass cards, and if you know anything about the history of European colonization, you combine those two together and you can imagine that the French government still has a database and active monitoring and surveillance of its former colonies, as the U.S. government says, following colonial patterns. But they can be trusted by the Germans and the Italians to keep an eye on their former colonies and the people who are troublemakers there. That is the grossest thing. And all that data is going shared with the Americans.

Caitlin
Yeah. And it's also worth noting that part of what they're trying to make these digital systems do is digitize the surveillance that's already happening in the sense that they were already sending like people into, I can't totally remember, I think countries to basically check people out. And they're trying to get the databases to do the same job.

00:39:32.44
Caitlin
And then last but not least, one of the things StateWash really flagged is that there's loads of well-documented ethnic profiling throughout policing across the Schengen area. And they flag particular countries where it's worse, but it's pretty well understood that ethnic profiling is a pretty serious problem across this part of the world.

00:39:49.85
Caitlin
And what StateWatch worries about is that the encouragement to use this new Common Identity Repository, which is the identity information from these various databases that the police can query for like incredibly permissive reasons. So police are already allowed to have a look at the visa information system, but the standards of higher usage of which has already been increasing, but it's less permissive. Whereas the Common Identity Repository they're allowed to query for like a much, much longer list of reasons. And they're allowed to see potentially a lot more information from their common identity repository. And so the concern is, if you're being told, do more identity checks, like run people through this new system, the people that you're going to be running through those systems are the brown ones. It's going to be the same people still being pulled over, but more with more information and more potential risks because of the integration of all these systems with all these sketchy other systems that already have huge data quality control problems. And it's just... a house of really sh** cards yeah and the end point of which is a nightmare at the physical border that you've got to arrive, you know four and a half hours early to make sure you can actually get on your flight.

Gus
Yeah. After you spent thousands of dollars or euros or pounds in order to get that flight.

[Music break]

00:41:15.94
Gus
Let's imagine there are some of you who listening who are saying, well, this doesn't apply to me. I am a US French citizen of no Algerian heritage whatsoever. And all my kids don't use social media at all. And so there's no way in hell I'm going to get caught up in any of these systems because I'm a good person. And the Turkish government has no reason to be angry at me and to declare my passport non-valid or anything like that. And every database that has my data that could ever lead to it being accumulated in this massive new database, all my data is crystally clear and clean and unproblematic. Then you get to the actual domain that PI covers on top of you know how sh**ty is US border policy and European border policy. And that's when you get to the UN.

00:42:09.88
Gus
So look, everybody has this approach to the UN that it's kind of pointless or it's where all the good people go and work and all the good work happens because we're all trying to keep peace and all of that.

00:42:20.68
Gus
And yeah, we agree the UN and and some of its institutions can be quite cuddly, but in those assessments of its cuddliness, people often forget that there's something called the Security Council where all the most powerful governments come together and make the real decisions. There's the Office of Counterterrorism that is always trying to pretend that it is very serious, working on terrorism and serious things. And again, with my old fartedness, there's the International Civil Aviation Organization, which is a Montreal-based UN agency. And they're the ones who essentially determine the fact that you now have a biometric passport and your biometric data is collected by governments around the world from that. We've been engaging with these UN institutions for years on their various problematic policies. But the one that we wanted to talk about now in the context of all this, and I don't want to get triggered into talking about biometric passports again, because that was my post 9-11 hell of having to try to work on that policy.

00:43:21.65
Gus
It's to actually talk about travel policy. And that is the UN Office of Counterterrorism, it must have looked at the world and said, oh, it's it's unfair that these Americans can build these advanced surveillance systems for travel. And it's unfair that Europe can do this. Why can't we help every government do this? And so they created this GoTravel system, like GoTravel. They actually gave it a stupid name, with even with stupid capitalization. So it's a lowercase g for go and an uppercase t for travel. And then they thought they'd be really cool and bring those two words together into one word. So it's called the GoTravel system.

00:44:00.44
Gus
Is that to make it more friendly or to make it sound more internet-y? I don't know. Anyways, it's a system that they want to provide to any UN member state, which is any government across the world, to allow for the processing of the exact data we're talking about.

00:44:16.70
Gus
That is all advanced passenger information and all passenger name records because again, it's unfair that only some governments get to exploit all this data. They want to make sure that you as that French American, non-Algerian, non-Turkish implicated person As you're traveling around the world with your friendly family members who don't have social media accounts, you can still face the same level of scrutiny all around the world. And it's just, you know, when we were looking at this system at PI, it just blew our minds that the United Nations would be endorsing such a system. Like when they deploy the system around the world, there's no compliance monitoring of whether or not governments are abusing this. There's no monitoring for abuses generally. And oh, by the way, just to go to the basics of Privacy 101, there's no privacy policy.

00:45:07.38
Gus
And so, you know, if we're talking about really advanced bureaucracies when it comes to immigration in the form of the US and the EU, if they can still screw this up, can you imagine how this gets deployed elsewhere in the world? But the UN is building it.

00:45:29.12
Gus
But, you know, we can't have a podcast where I don't also get angry at the UK government. I'm going to bring this home for Caitlin and I. You know, she thinks she's being wise this summer by not traveling outside the UK and that she'll somehow be fine. And oddly enough, to some degree, she would be. But the closer she gets to a border, which is basically the water, ah she's got to get closer and closer to problematic practices. Because, like, the UK government loves to police its borders.

00:45:58.94
Gus
For years, even as you are traveling to the UK from somewhere else in the world, you'll notice that you get extra checks at whatever airport you're at, and it's because the UK government has already negotiated that level of additional scrutiny. And it just it's the beauty of having His Royal Majesty as your leader and head of church. But what's interesting is that Parliament in the past few years has also been very keen to give the government powers at the border. So, when you land at the border, they are increasingly doing searches. So one data point we could find, because there's so little data on this, is that there are about 1.5 million searches of people at the border of the United Kingdom annually. And that includes body searches and so on and so forth. But like the power of that PI looks at particularly is the power under the UK Terrorism Act of 2000.

00:46:54.17
Gus
So again, pre-9/11, where there's a Schedule 7 that allows them to stop people at the border with no prior suspicion of terrorism. You can be detained for up to six hours. They can collect your fingerprints and DNA. And you may be required to provide any information that they request, including pins and passwords. And it could actually be an offense to [not] comply. And so that's why, again, I get really annoyed with all this travel guidance that people give to say, oh, you know just turn off the biometric on your phone so then they can't force you to look into your phone in order to open up your phone in order to give access. And they also say, oh, store data in the cloud rather than your phone, then you'll be fine. Actually, that doesn't help you in the UK. The UK can force you to disclose your password, whether you like it or not. And if you don't comply, then that's an offense.

Caitlin
And that's UK and non-UK citizens. It doesn't matter if you're UK citizen. There are no additional protections that you get. And if you are convicted, which many people have been of a Schedule 7 terror offense, it's a terror offense. So when you're disclosing, for example, because you want to get a job in the UK, you have to say, I've been convicted of a terror offense.

00:48:07.10
Caitlin
Even if that terror offence was, I'm a lawyer carrying information about the torture of a guy that the UK participated in, torturing someone with the US, and I don't want to give you that information, then nonetheless you can be convicted of a terror offence.

Gus
And so the irony is that, I hate to use the word irony in this context, like this power to stop and search people's devices, UK is expanding and it's because of this so-called migration crisis that's happening.

00:48:36.70
Gus
And It is i guess this is the appropriate use of the term irony where the people who are angry about migrants are pretending to stand up for the rights of British people.

00:48:48.92
Gus
And this power is actually being used against them, too. There is a fascinating case. involving, and really have to avoid swearing in this one, but it's a case that deserves to be heard, which is there's a far-right activist leader in this country called Tommy Robinson. Well, that's what he wants to call himself. His real name is Stephen Yaxley-Lennon.

00:49:13.88
Gus
And he was stopped while traveling with his car and he was at the EuroTunnel and he got stopped. And because he was giving vague replies to the questions being asked of him, he was forced to hand over his phone. It was an iPhone in this circumstance. And he was being compelled to disclose his PIN for the phone, and he refused.

00:49:41.27
Gus
And so he was prosecuted. As Caitlin said, you get prosecuted as a result of this. And actually, well, his case was thrown out. It went on for a good while and he needed financial support for his case, and it was provided by the small unknown tech joiner called Elon Musk. So Elon Musk funded the legal case to support Tommy Robinson or Stephen Yaxley-Lennon on this case because Tommy Robinson said, look, I'm not going to give you my phone data because there's journalist material on it. And so he was trying to fall into the protections that might exist for journalists.

00:50:18.46
Gus
And then he argued in court or his lawyers funded by Elon Musk. This case was brought to you by X. They argued in court that he was being discriminated against because of his political beliefs.

00:50:30.52
Gus
And actually, the judge agreed. The judge agreed that he was targeted for his political beliefs and that he was targeted based on an arbitrary decision based on who he was.

00:50:42.14
Gus
And it was a protected characteristic under law. So he was, yeah, he was forgiven. All was fine. Not many people get that level of protection or legal support.

Caitlin
No.

Gus
It's extraordinary.

Caitlin
And it's worth in some respects noting that Tommy Robinson, Stephen Yaxley-Lennon is not a friend, but it's a good thing that this case was thrown out. like This isn't a power that should be allowed to exist and challenges to Schedule 7 and that power, they're a good thing. If you're the director of CAGE, which is an anti-torture organization the UK, who gets pulled over and gets done with terror offences, he got convicted and all of his appeals failed. They're refusing to hand over passwords and your your PIN number to your phone and your computer because you have, in that case, protected information about your client who has been tortured. It's good that that is undermined.

Gus
So should we be asking Elon Musk to set up a legal fund for all people who are stopped at the border? Or do we have to say it's only for some people?

Caitlin
I think it's worth noting that Elon Musk's political opinions and who he believes to be worthy of defense and legal defense is not predicated on any persistent moral principle. Instead, it seems to largely be predicated on people he likes for now. But yeah, like...The possibility of being done for a terror offense because you didn't want to hand over your PIN number for your phone or your password for your computer, particularly where you have protected information or information over which you are, for good reason, protective, like it's a bad power.

00:52:18.42
Caitlin
It shouldn't exist. And the lack of safeguards involved in that power. Like the lack of suspicion required, like everything else that you've already said, they're bad. There needs to be safeguards. If you want the power to exist, there needs to be like a minimum level of reasoning why you pulled someone over. In Tommy Robinson's case, it can't be because I saw it was Tommy Robinson and I thought, oh, that's Tommy Robinson. I'm going to pull him over. like There needs to be a genuine basis and a reason and safeguards. You know.

Gus
And this is why we're talking about borders ultimately and why we're talking about travel. There's nowhere in the world, no matter how American slash French you are, there's nowhere in the world where you're more powerless than the border of a country.

00:53:01.46
Gus
Even if it is your own, you are still powerless at that border and unless Elon Musk is your friend.

Caitlin
Well, even if Elon Musk is your friend, while you're in the room with the border agents who are yelling at you, like you're really hoping that Elon Musk comes through for you in the ensuing court case, which I don't think he's the most reliable of people.

[Music]

00:53:28.44
Gus
And then the final aspect is, okay, you're a French American with no links to any government around the world who might not like you, but you might have to deal with the shifting geopolitical patterns.

00:53:42.49
Gus
And the most recent example that is worth ending this podcast with is one that's so insular, so inside baseball that I'm amazed Caitlin is allowing me to talk about it, mostly because i think she's going to see if I'm going to swear, which is every year in the NGO world that we are a part of, there is a huge, I'll use the proper terminology, conference. I've called it more nefarious things, where people come together and they fly from all around the world, they come together to talk about digital rights. And this year, that conference was supposed to take place in Zambia. And the conference was going to include speakers from Taiwan, and it was going to talk about issues relating to China. And the conference organizers had negotiated very intensely and openly with the Zambian government about making sure that people from around the world could travel into this conference. So let's imagine that American French person with very kind kids was traveling in to Zambia for that conference. Well, at the last minute, the conference was canceled. And when trying to make sense as to why the Zambian government had all of a sudden gone cold in the conference, the conference organizers claim it was because the Chinese government put pressure on Zambia and the Zambian government. And in fact, one piece of reporting from Zambian media said that the conference of venue itself had been a donation from China. And this hints to China's increasing role in the world, particularly, let's say, in Africa, where Chinese government funding and Chinese industry funding is part of the economies of these countries now. And, you can't afford to annoy the Chinese government. So the conference was essentially canceled at the last minute, inconveniencing countless digital rights advocates from around the world. And it got so high profile that even the UN, the United Nations Office of the High Commissioner, who was a much...

00:55:43.44
Gus
We love this office, but because you can imagine we love this office, so it has very little currency within these kinds of fights, unfortunately. It was demanding why the Zambian government had decided based on national values and policy priorities to essentially stop freedom of assembly of people from around the world and from Zambia. Interestingly, Zambia has an election coming up, and so things like this don't bode particularly well.

00:56:09.40
Caitlin
So RightsCon is immensely complicated, right? Like in the ideal world or the ideal vision for RiceCon, like people from every single country in the world can go.

Gus
But they shouldn't. it's Well. Sorry, I shouldn't say that. But I do say that. They should not be traveling to a conference. Like what why why do we need a conference? Anyway.

Caitlin
But the idea is that every single person in the world gets to travel to it. But in practice, visa rules have not been kind to this concept. And so the one time that I went, it was in Costa Rica, and a specific fast track visa scheme had kind of been negotiated.

00:56:41.78
Caitlin
So the idea was to make sure as many people and from as many countries as possible could get into Costa Rica. And the first day, the introduction announcement to the conference, they had to bring out a Costa Rican government official, basically, because everyone was so mad because this visa system had not been working. And lots and lots of people who were supposed to come had not been able to use this fast track visa system to get the visas. But because it was supposed to be a fast track visa system, like they didn't have the time basically to get the proper big fancy visa. And whilst the geopolitical implications of this cancellation is much more dramatic than the kind of yearly visa nonsense that people have to deal with, like there is visa nonsense every single year. And we have global partners, right, that we try and invite to places. And our Ugandan colleagues can never get UK visas. And it's because the presumption is that they will want to stay.

00:57:33.82
Caitlin
And one of our Ugandan colleagues got basically a letter from the UK government saying that, like, we don't think you'll leave if you stay. And she said, I've got an organization I run, I've got family, I've got a life in Uganda. And frankly, I don't like the UK that much. Of course I'm going home. It's just such a patently like sh** system.

Gus
And all the performance you have to go through in order to comply with even the ability to apply and to then get refused. So like in order for us to invite our Ugandan colleagues or any of our colleagues from anywhere around the world, we need to book a flight so they can show up and say, here's my flight booking. We need to book a hotel so they can say, this is where I'm staying.

00:58:14.97
Gus
And these things have to be paid for. All for them to be told, no, I'm sorry, you you can't come to UK...

Caitlin
And it's not, I'm sorry, either...

Gus
...To visit an organization that is registered charity in the United Kingdom. And it's like, oh, it just blows my mind.

Caitlin
And the patent racism inherent in Uganda is not that nice. The UK is so much better. You definitely want to stay. Even when it's just not inherently true.

00:58:37.77
Caitlin
It's just not true. It's infuriating.

Gus
And let's also remember when people have to apply for visas, they need to go to the embassy and guess where the embassy is? It's always in the capital city. And so if you don't live in the capital city, you have to travel for hours in order to get there at a specific time and to be treated like a potential, well, yeah, to be treated as though you're a criminal.

00:58:59.10
Gus
Yeah, so that's why we've covered these issues. And so just to bring it all together, it's sh** and it's getting sh**tier. And if you think that because you're a citizen or because you have permanent residency or or or... The reality is governments are trying to treat everybody the same way, whether you are a citizen, whether you are a permanent resident, they want to find ways to get all of your social media accounts and even your DNA in order to put them into countless databases like the ones that Caitlin said very well summarized without using too many acronyms.

00:59:33.75
Gus
And they want to make sure that this power exists for every government around the world, and they also want to make sure that all these governments are sharing this information. And it's like, this is the way that this is the way that it is. And it's just extraordinary. I still remember a time when it wasn't like this, when it was considered outrageous to do these types of things. But there's something about the last five years, particularly, and I think we know what it is, that has created this environment where there's no border policy that is too crazy, you know?

01:00:11.67
Caitlin
Yes. But it does mean it's new. Like it's a new trend, which means it's not an inevitable trend. It's not an inevitable part of your border security. It's a new trend and new trends can be undone.

01:00:24.47
Caitlin
And the information in the various EU databases is not going to be made better by the fact that they're just going, these checks are not necessary because the queues are too long.

01:00:35.61
Caitlin
You know? Anyway, we'll let you be free.

Gus
So on that note...

[Music]

01:00:52.41
Gus
Thanks for listening. You can sign up to be the first to learn more about our work at pvcy.org/podsignup. We'll include many, many links to relevant articles and information in the description wherever you're listening or on our website at pvcy.org/techpill.

01:01:11.80
Gus
For what it's worth, we might have to apologize to you that the part of our website that hosts our videos is currently down. By the time this podcast is released, we hope it's back up and running. And we kind of blame, not ourselves, but the fact that there was a critical vulnerability found in the server application and we are trying to deploy the patch. But it's taking us a while, so it's better to have the system down than to have an unpatched system.

Caitlin
It's PeerTube.

Gus
The wonderful people appear to have done a good job.

Caitlin
So we host stuff on our website through something called media.privacyinternational.org, which you can go to and you can look at, except you can't because it's down. But what that is, is it's Peertube, which is like a federated, funky version of YouTube. The downside of it being a federated, funky version of YouTube is things like critical vulnerabilities, which suck, but...

01:02:02.95
Caitlin
it's much better to take things down and fix them properly rather than have critical vulnerabilities lurking around our systems. So if you're like, oh nuts, I only listen to the podcast on your website or ah nuts, I only listen to your podcast on media.privacyinternational.org.

01:02:19.35
Caitlin
A, the way that because Peertube is federated, you should be able to listen to old episodes. So not this one. So go away. But old episodes on other people's Peertubes who mirror us or who follow us. But also YouTube exists. It's not as good privacy wise, obviously, as media.pi, which is why we use Peertube. And there are lots and lots of podcatchers that you can use. So obviously you've got the big ones, your your Spotify, your Apple Music. Unsurprisingly, lots people don't like them. Privacy-wise, not always the best, but there are lots of others that exist for podcasts and that take the RSS feed.

Gus
But if you ever want to send some love to the people up here to you who such good work of trying to have an alternative to YouTube, please do.

01:03:04.09
Gus
And along the way, whichever platform you're using, don't forget to rate and subscribe to this podcast. Music courtesy of Sepia. This podcast was produced by Max Burnell for Privacy International.