 Also, es geht darum, ist Österreich ein Überwachungsstaat oder ist das nur... This talk will be examining whether or not Austria is a surveillance state or whether this is just amateur digitization. So welcome to the stage Thomas Lohninger and Angelika Adenzamer. Oh Gott, ich und mein Aufschreiben, ich kann nicht mal meine eigene Schrift lesen. I can't even read my own writing. She's a policy advisor. So something like your lawyer, is that right? Natarin, ich habe keine Ahnung. Juristische Beraterin. Legal advisor. Cool, dann. Herzlichen großen Applaus, bitte. Applaus. Hallo und herzlich willkommen. Hi and welcome. We have been introduced. It's a bit unfair because we were practicing in the speakers room and he's, he heard us the entire time. We want to talk about Austria and the things that happened in the past year with the very conservative government. But first, let's talk about who we are. We work for epicenter works. We work in Vienna, but have a lot of European work as well. It was founded in 2010 as a society to overthrow this mass data storage. And that worked. The European law no longer exists, but we have similar forms of mass surveillance even today. In 2015 we approached a new thing to do and that was an internal secret service in Austria that was being founded there. And we were sure that there was potential for abuse with such broad privileges. Another thing is net neutrality. We started the campaigns savetheinternet.eu and after many, many lobby campaigns we've reached some great protections for net neutrality in Austria. There's no talk on this subject by me this year, but next year there'll be a reform of net neutrality in Europe. And something people are very concerned about in Austria and in Germany is the state Trojan. So state sponsored viruses, state built viruses that are used for surveillance. But let's look at what happened in Austria in the past year. Finally we're back on the world stage. Sebastian Kurz, the Austrian Chancellor, managed to get on the cover of time. There are not many Austrians who managed to do that. And he was being heralded as the new face of the right. The federal government in Austria are the FPO and the ÖVP parties. And here's a symbolic image of what that means for democracy. Unfortunately that's a real photograph. And of course we have to do with a mass of topics here and we are going to leave the core area of net politics. But everything was easier back in the days. Look at the Heimdudler Ashtray in the background. Angelika's first reaction was my favorite. This is where they want to get back to. And it was easier back in the days because the politics didn't understand the Internet and it was something that was easy to ignore. Today it's a core issue. We looked at this manifesto in the first 24 hours and published a color coded version of it. This version summarizes that there's a new surveillance package. There's a broadening of surveillance powers. And Internet politics is essentially industry politics. There's still no transparency law and European law is being broken in a few places. The European Union was also important because we had the presidency. And this meant that many European topics that should be done, would usually be treated in Brussels, were now being discussed in Austria. We also were presidents of the European Protection Board. We had to reach European consensuses. And even though there are, we had very few privileges there. We also had the presidency, held the presidency of Berek. We had a lot to do in last year. One topic that was a huge subject was the surveillance package. That was the same as last year. And after eight months of campaigning against this, we were able to overthrow eight of these 12 proposed measures. And we celebrated this as a success and the minister resigned. But that was when the extremist right-wing FPO was an opposition party and opposed these surveillance measures. And also opposed the FPO, who proposed these measures. Now both of them are part of the government. And they've evidently changed their mind. The surveillance package has returned. Here's a small overview of what's in there. One of the measures is state-run spyware, the broadening of CCTV, the use of IMSI catchers, the use of license plate recognition, bulk data storage. That is slightly different because there is a very low threshold. The registration of SIM cards is going to be obligatory because we're going to see changes in letter secrecy. And we went to protest this at minus 20 degrees. We were very unlucky with the weather at our protests. And there was a lot of criticism even in 2017. But when these were proposed again just a year after, we really went to take the streets again. And we also had a lot of arguments about the hearings, which were supposed to be non-public. And as is Viennese tradition, when we met with the opposition in a cafe, we flew in Konstanz Kurtz and our lawyer explained our criticism to all the opposition parties in front of the media just to get it out there. So, in the Wednesday, the following week, the security package was passed in parliament. And how should we be guaranteed that in Austria, where the gap in the law was, that the gap was left open deliberately, an Internet, a security hole, a backdoor for children is left unpatched so that you can query and research. And that's because I'm asking, how can you guarantee that this won't happen in Austria? We can't really see the connection between IT security in the public sector and the security package, I have to tell you. But I think these are two very relevant, but different topics. Sebastian Kurtz is about my age. He grew up with the Internet. He should understand these things. And you see what our job is. They lack technical expertise, so they have to be able to understand all parties. And particularly regarding the federal state Trojan, there are complex issues at stake. The knowledge that there is a security hole is required that a Trojan can be installed. And that such holes can always be used by third parties is something that in most countries simply doesn't occur in the debate. And we managed to get this information up to the Chancellor, the head of government. And as soon as the software will be in use in Austria, I think the debate will go on. Sadly, it won't be the case that IT security will be better in Austria than in other countries. And the person that made it most clear was our Technology Minister, Norbert Hofer. Well, if I'm hacked, I will then be hacked. Yeah, but actually this surveillance package isn't that bad kickle. The Interior Minister says about it that it's targeted, effective, proportionate, surgically precise and equipped with a package of legal recourse, legal securities. We looked at whether this is true and we looked at legal securities and you have different measures here in this graph and the measures against them, you see a red dot. So you see that these are points where legal protections are missing and we then looked at whether this is surgically precise and not a mass surveillance measure. And then we thought, well, if we are talking about surveillance in the public space, that's something you can hardly evade and data storage that can be used across the board, registration obligation for SIM cards. These are mass surveillance measures and a bit of mass surveillance is already too much. These measures are now going to come into force one after the other. The first ones are in force. The ones with the red frame are in force since June 2018. For the others, there's a bit more time. The state Trojan has been postponed until 2020. The law is passed, but it will only be applicable from 2020. There is development work going on and they see whether everything is feasible and it is going to be extended in 2025 automatically unless Parliament votes otherwise. And we consider this a measure that is illegal against the Constitution, but unfortunately we have very little ways of recourse. We hope that the opposition parties, as one of the MPs has already announced, that they will go to the Constitution Court und have this checked. What else was very important this year was the BVT affair. The Secret Service will be known to some people now this year. We have been dealing with it for a bit longer from the time when the legal foundation for this Interior Secret Service was created and we already then said there is hardly enough Kontrolle und Transparenz und to cap it all, to crown it all, we have now a search or home of this Interior Secret Service because of corruption and North Korean passport templates. In that search, data about the right extremist scene from the head of the right extreme department were taken. This is someone who wasn't actually accused of anything in this. And what does this have to do with the Interior Minister? Well, his highest civil servants, that he selected himself. He went along with witnesses to the court and told them to enforce the accusation so that this search would take place. And so we have a FBO politician involved in this search minutes that say that they took a plastic bag of hard disks and surely this is something that the Investigative Committee that exists for this Interior Secret Service will have a lot of things to clarify and it's good that this committee looks at both scandals. The one that happened under the Interior Minister by the FBO, the right wing party, because there's a lot to look at what this service actually did since its inception in 2002 and then the second affair under Interior Minister Kikkel, this rebranding. And we know that the search that was conducted was illegal. That's what has been resolved, judged by the court, ruled by the courts. But then tactics were changed. Kikkel is no longer trying to rebrand this using the home search, by looking at secret services as a whole because we have no separation between secret services and police and the threat that head positions will be rebranded is very strong. Another thing where security apparatus is being upgraded is the police and justice, but also the police, 11,000 new jobs are going to be added. At the same time, Interior Minister Kikkel is lowering the hurdles concerning reading and writing capabilities. So the police ranks, they are trying to fill and we had this campaign. Has Kikkel gone yet? There was a site, no, but for a long time but these days you can sign a petition there for the resignation of Mr. Kikkel, Herbert Kikkel. This site will stay up as long as Herbert Kikkel is in office so you can pass it on, tell your friends about it. No internet politics review would be complete without the GDPR that went in force, that came into force in May. And the panic of course was huge with large fines that could be imposed and with requirements to change national laws. That was a very long process in Austria as well even though this was known two years beforehand but of course there was a flood of changes in laws in the first quarter of 2018 including the fact that sanctions or fines that are enshrined in European law shouldn't apply initially. That's a fun idea but it doesn't work that way. People think that we don't have fines in Austria but that's just not the case. Another thing that's very worrying is the fact that surveillance is used disproportionately against minorities. Some examples of this from the past year. This is an algorithm that is used for unemployed people to help them find work. And these are being split into three groups. The first of these is group A, that's highly educated people who don't get any funding. There's a group B. Group A does not get any funding. Group B gets most of the funding and Group C is fairly hopeless and again gets no funding at all. And this algorithm downgrades people who have many children or live in the countryside and therefore more likely to be part of Group C that does not get any funding at all. And the justification was that this simply mirrors the discrimination that already happens but, of course, this simply furthers discrimination. There's also a dragnet investigation in health data. Insurance companies have to use risk assessment tools and have to screen how many people call in SIG if this happens too frequently or too long. All this has to be double checked and all this is supposed to make these companies more economical. Angelica mentioned that many things crossed our desk in the past year. We went the extra mile and read all of them and there was one law where we had to act immediately and this law wanted to open all public databases for research and that can be financial data but also health data and that can be used by universities but also by Cambridge Analytica. That just lay about as a law. Nobody cared but we discovered it and showed this to opposition parties to the media. We tried to raise awareness but nobody was interested and we finally met a journalist who ran the story and suddenly it was in all the papers. And now there's an ethics board and everything has to be cleared by the individual Ministries. There's no longer any, it's no longer as easy to sue but these data have to use pseudonyms but it's very easy to discover correlations. Just last week there was a draft social welfare reform with access to all kinds of data on household data and other data and what was also planned in this measure was that the nationality of the biological parents was supposed to be accessible. So that gave it the Aryan's paragraph because there's no way that you could understand why the nationality of biological parents should be of interest. But that of course shows you where this all is going and also with asylum procedures which has been severely restricted. Again basic rights were massively restricted also concerning privacy rights so authorities were allowed to ask asylum seekers to hand over their mobile devices and have them read out completely. That's a much stricter measure than those affecting the accused in criminal procedures, criminal court cases. At the same time medical secrecy rights were restricted so doctors have to now report or give information on those that seek asylum or those that are going to be deported and we in this area network with other NGOs that are not just from that net politics field that has been very valuable and the fact that we could add our expertise on privacy and net politics and bring it together with expertise in the social securities and asylum procedures. The solidarity pact was a pact of NGOs kind of that we funded with other NGOs and one of the largest in Austria is involved and 60 others have now joined as well and the idea is that when attacks on civil freedoms happen you would stand together and join forces and if some NGOs themselves get attacked which in times like these does happen this is very important. Another thing that had to be implemented this year is the passenger data processing directive and this is about storing passenger name records and surely this directive is in violation of EU basic rights because there has been an ECJ judgment about exactly this data between Canada and the EU. Austria didn't only implement this directive but also even what they called gold plated it and passed stronger measures than was required at the EU level. The requirement was that flights into the EU or out of the EU should underline storage but not interior EU flights but that's what's included in the implementation in Austria. It's about the whole record that is very broad everything that's connected with the flight so that is of course departure and destination the places and the names of the people involved booking details, the time of the booking the payment method and also information on the seats assigned the meal choices which of course gives you an insight into religion at some time and this will then be passed twice to national authorities and that's before departure and after arrival and that of course is excessive and that has been confirmed by the ECJ and we will be going to the courts against this together with the Gesellschaft für Freiheitsrechte in Germany we are optimistic that this will be abolished just like data retention in order to not have to clear up things nationally after things have gone wrong at the EU level it's important to deal with EU topics early on because you are most efficient as a small organisation in the EU if you are there early and a topic that has been engaging us is the copyrights directive we warned against these upload filters as early as 2016 saying that there are nothing but the censorship infrastructure that we know from China because people's contents are checked before they can even appear and that creates a very dangerous precedent and we warned that upload filters as soon as they existed just like every infrastructure would be extended and we were confirmed by now we have the terrorism regulation that even before the copyright directive is finished wants to use upload filters against extremist content but there's more in this copyright directive this is ancillary copyright for publishers and this is dangerous in times of fake news when the task is to spread and quote journalist content and not prohibit it we've been on the road against this law for a long time and we want to take actions of different kinds to show that this is a one-way road for the internet as well as for society as a whole and a network life that is going to be threatened in our democratic times is very important to have these rights and these actions have not just been taking place in Vienna but also in Graz and Innsbruck and the last we did was how to press conference with the head of the Wikimedia Foundation in Vienna because Wikipedia of course is particularly affected by this they have hardly any copyright violations because they have an active community but they quote press content a lot and maybe soon they will not be able to continue as they have been acting before when this ancillary copyright happens Axel Faust the rapporteur was very happy when he got his file passed in the parliament but this law should not make you resign or should not make you give up because there is a chance after the trilog negotiations this will come back to parliament and also the EU council when member states decide Italy with its new government has been in confrontation tough confrontation and even if we lose this we can promise we will keep working at the national level and Angelika has already said at PNR we do this even if a law like this is passed when it gets implemented at the national level you can still do something and the highest courts are still there for you lets sum up a year of presidency in the European council we have debated a lot of things one thing we didn't manage to to for which we didn't have any time was the e-Privacy directive the European flag committed suicide I don't want to end on a depressive note it's also the last talk of the day and I don't want you to get too drunk the successes we had that nobody would have noticed otherwise let's start simply it's the law for sorry the implementation of the NIST directive a law on I didn't catch what it was so things have been copied from our papers it's good if people listen to small organizations and we were very happy but what stays in place with this law is a certain two faced character because the Interior Secret Service, the BVT is now the authority responsible for the NIST because that now tells us that they are responsible for keeping us safe from hacking but also responsible for the State Trojan so there is a kind of conflict there also in Austria you have a right for three years you have the right to complain if you believe that your privacy has been disrespected and the Interior Ministry wanted to abolish the period for police access to data to two years so I would have been a gap and we went to the Interior Ministry in the snow here and gave them a hard disk with some storage space because the reasoning that protocol data could only be stored for two years would be storage minimization so we thought okay we can solve this we'll send them a hard disk and yes great that has been extended again to three years another nice thing Telecommunications law in Austria was changed we earlier this year we looked at all the sanctions for net neutrality violations in Europe and created this overview of where the countries are at in some countries it costs it can cost up to 9000€ but in others it can cost several millions and we showed the countries how good or bad they're doing at this and these of course are enshrined in national law Austria was in last place together with Portugal and Ireland because we had no sanctions at all but this year we're in first place with 10% of global revenue and that's more than the GDPR and we were very happy about how much Europe improved over the course of a year we were very happy the same law goes through another round of input people say whether they think it's good or bad and before this happens before it's sent to parliament and after this the law included a new form of data retention dynamic IP addresses that everybody was users would have been subject to data retention and they would have been easier to use in copyright infringement sanctions as well and we reported on this and we were able to prevent this new form of data retention together with ISFA let's take a short look at the future we know about a few things that we already know about a few new things one thing is going to be the real name the obligation to use real names in social media where people supposedly will be required to sign up with a registered SIM card or an ID card there will no longer be any anonymous SIM cards in Austria starting from the 1. of January but you can also create you also have to use real names in social media this is supposedly to deal with hate on the internet with but this is of course not going to solve that problem but it's going to create huge privacy headaches there's also going to be network network law after using the German example in Austria and we are looking at the proposed implementations of this we are also going to publish a new version of our handbook of anti-terror measures which is which is going to propose evaluations of anti-terrorism measures and proposed ways to reduce and to abolish measures that are not accomplishing their goal and we already did this a few years ago but we want to update it and want to encourage amateurs to take part in the legislative process okay, not much to add but I just wanted to say that we don't all do this in our spare time these days although of course it started as a hobby for many of us we are a team of 10 now working in our office in Vienna and we have much more work to do at the European level but we have many plans at the national level as well and the more support we get from civil society the better we can work so we try to be as efficient and cooperative as we can just about every document and every data record that we use can be found on our websites there are meetings every month the net political evening and the coordination meeting and at the end it's also about the contribution by supporting memberships and donations that makes this possible to plan in the long term and that's very much necessary these days so supporting members now we'll get a welcome present from us from t-shirts to the camera covers quite useful stuff sometimes look at this and see we want this kind of size that we've reached we want to maintain this and for that we need people to support us and otherwise it will be an unequal fight and we would hate it to have to tell you that the other side will win if you have more questions we have a Q&A but we will also have an assembly in the freedom cluster near the entry stand we will be there from 12 to 5 tomorrow thank you thank you for the talk and your work and you know the drill we have 4 microphones we have the internet and we'll start with the internet you mentioned the has Kickel left yet petition but that's non-binding petition why why didn't you start a petition on the government website that would have to be treated in parliament well our experiences with these civil citizens initiatives were kind of bad at the time of data retention we started the largest civil initiative that we ever had in Austria led to nothing and the address of this message is not the parliament anyway it's Sebastian Kurz, the head of government that can dismiss Kickel and parliament can only dismiss the whole government as well as van der Bellen the president will address the chancellor and tell him to be responsible and at the same time I have to say that we designed it this way so that the data of people that critically speak out against this government will be given to the chancellor but only will be handed over to the president's office because we believe that van der Bellen the president will deal with this data in a responsible way that has an FPÖ right-wing parliament president and with such a permit I wouldn't be so sure that the data will be treated well Mikrofon Nr. 1, bitte und schön nah dran gehen, bitte Es wurde gesagt, dass Auffälligkeiten im Verhalten also beim Krankenstand jetzt habe ich mich gefragt ob ich eigentlich nie krank wäre Es war sicher dass die Gesundheitsdata wurde analysiert was passiert, wenn ich nicht krank bin Das war ein bisschen ungewöhnlich dass es eine nontypische medizinische Situation ist also ein normales krankes Behaviour wird nicht konspicuös sein und wir haben der Kongress-Disease Sie haben gesagt dass die Doktor die Konfidentialität verweigert war Was waren die Reaktionen da? Ja, das gab es Es gab ein Revue-Prozess in dem man die Position handeln kann und ja auf vielen Levels ist das ein Problem weil Doktoren nur nach der Patientenwahl die Prozesse in diese Position und in dieser Prozesse ist wirklich sehr schlecht und es hat diesen schildrigen Effekt dass man weiß ob man an den Doktor gehen sollte anyone else? Nein? Nein? Dann einen guten Abend und vielen Dank für die Translation und die Interpretation