Methods, sources and implementation - Use of personal location data by the police

2.2.1 General

The investigation we give an account of in Part I of this report is based on in-formation related to two groups of countries. One part relates to a selection of twelve identified (mainly) European countries (“national studies”). The selection of countries participating in the national study was made as part of the approved research design in the application to FP7. The second part of the investigation has been directed towards national Interpol offices all around the globe, included of-fices in Europe (“Interpol inquiry”). Since the research design laying the basis for WP7 was based on the condition that the identity of these offices should not be known, and that replies should only be classified as belonging to certain regions of the world, we have not been able to match results from the Interpol study with the national studies. Thus, the two parts of the investigation will be presented separately.

The research design of the Interpol inquiry was based on prior knowledge of the law enforcement sector where it was clear that law enforcement agencies are very reluctant to divulge information of the type required by the RESPECT pro-ject. In order therefore to encourage a number of national police forces to provide some information, it was decided to offer the possibility of using RESPECT part-ner INTERPOL as a trusted third party which would be responsible for acting as a filter and anonymising the data collected from any particular national police force. In this way it was possible to elicit a number of responses from European countries and beyond, though the anonymisation of the data would prevent the

10 We assume “position” may be best suited when we do not know name of the place.

RESPECT research team from achieving direct corroboration or any form of tri-angulation with the national reports obtained otherwise.

The following investigations were carried out as part of the national studies:

• Inquiry directed to the national telecommunication authorities (“telecom in-quiry”).

• Inquiry directed to the national data protection authorities (“data protection inquiry”).

• Inquiry directed to Internet service providers operating in the national mar-ket of each country (“ISP inquiry”).

• Document studies in government dossiers etc. in each country (“document study”).

The list of national research institutions participating in the telecom inquiry, data protection inquiry and ISP inquiry is included as annex 1 to this report. From some of the countries, it proved difficult to collect information. Thus, most of this report concerning the national study is based on answers from eight of the twelve countries originally included in the research design.¹¹

Nonresponse from the four countries listed in the table is due to different circumstances for which we have no full overview.¹² The major reason is probably that the national research groups did not succeed in getting responses from the relevant authorities and ISPs.

Some of the authorities which responded to our inquiry did not answer every question. Such omissions will be commented upon when we present the results.

Statements in the inquiries are to a large extent worded in ways which enable different interpretations. Such problems occur, of course, in most research ques-tions expressed in natural language. Our inquiries are to a large extent exposed to this challenge. This is first and foremost due to three characteristics. Firstly, some statements are formulated by means of terms from the legal domain which do not necessarily have equivalents in each of the national languages applied. Secondly, and probably most importantly, several statements are worded on an overall le-vel taking PT technologies as example. These technologies have many and very different uses, and thus answers may rely on specific conditions and situations.

Thirdly, since questions highlighted issues regarding police investigation, secrecy limitations were foreseen. We were aware of these problems and thus stressed in the introduction of all inquiries that:

11 These eight countries are Austria, Bulgaria, Germany, Italy, Norway, Romania, Slovakia and Slovenia. Regarding response rates etc. of the Interpol inquiry, see section 2.2.3.

12 In Malta for example the data collection period coincided with the run-up to and the aftermath of national elections including a change of government, a process during which it proved difficult for data to be gathered since many officials were reluctant to take action about requests for information.

“We are fully aware that aswers to questions may be uncertain and thus based on approximate assessments of the respondent . Although we expect that our questions should be possible to answer within legal regulations of secrecy, we also respect that some issues may be too sensitive to answer. In these cases, please indicate that the information could not be given due to secrecy reasons.”

Regarding the two first problems, we seeked to counter unwanted effects by invit-ing respondents to give comments and additional information to every question.

Some general statements from respondents expressed problems of answering our questions.¹³ However, supplementary comments were very few. Nontheless, an-swers to some of the questions indicate that respondents may have based their replies on different conditions. In the presentation of results we will highlight such uncertainties, see in particularly in chapter 5 and 6.

2.2.2 National studies

All four questionnaires applied as part of the national studies were brief and mainly based on a multiple choice technique, often related to statements where respondents were asked to choose one or several alternatives by ticking off a box.

Comments were allowed on all sets of statements, and in some instances even to each statement.

The use of a questionnaire makes it easy to compare answers from different countries, but was mainly chosen in order to increase chances of a high response rate from relevant national authorities and ISPs. Another concern was to mini-mize work load for the national research teams. Almost all teams were members of both the RESPECT and SMART project, each project with many work packa-ges. The idea was that brief and simple questionnaires would make it simple for national teams to follow up and have responses from telecom authorities, data protection authorities and ISPs.

In order to facilitate high response rates, national questionnaires were trans-lated into the respective official languages. Translations were organised by the WP leader and checked by the respective national research teams. Questionnaires were then communicated to national telecom authorities, data protection autho-rities and a selection of ISPs in each country.¹⁴ We received answers from:

• Eight data protection authorities,¹⁵ of which two (from Italy and Romania) were only brief statements;

13 For instance, the data protection authority of Slovakia commented to question 4 of the “data protection inquiry” (see below) that “We believe that results from this questionnaire may be difficult to interpret and may even lead to the wrong conclusion ...”.

14 Our intention was to receive answers from a minimum of three ISPs from each country.

15 Authorities in Austria, Bulgaria, Germany, Italy, Norway, Romania, Slovakia and Slovenia.

• Nine telecommunication authorities in eight countries;¹⁶

• 20 ISPs, ranging from six to one ISP in each country.¹⁷

Some responses were incomplete in the sense that a few statements/questions were not answered, but this has no significant influence on the applicability of re-sults. A few of the authorities made comments, but the main picture is that results almost only exist in the form of responses to multiple choice questions.

The scope of inquiry and the number of responses of course do not give a representative picture of the European situation, and percentages and average fi-gures are thus not meaningful. It is of interest, however, to show similarities and differences on a country level of selected points included in the questionnaires. It is also of interest to see the degree of concurrence and dispersion of replies. Our investigation does not, however, allow us to explain similarities and differences.

2.2.3 Interpol inquiry

The Interpol inquiry was directed towards police authorities in all 190 Interpol offices, and carried out in collaboration with the Interpol headquarters in Lyon, France. Use of a questionnaire was mainly chosen in order to increase chances of a high response rate. This was particularly important with regard to the police in-quiry because Interpol offices received several questionnaires in addition to those connected to RESPECT WP7, both other work packages in RESPECT and in the SMART project which was carried out according to a similar design.

A draft questionnaire was made by the WP leader, and sent to each national research group and the Interpol office in Lyon. Feedback from Interpol caused several changes of questions and design of the questionnaire. With Interpol as intermediary, these questionnaires were anonymised. Thus, the identity of the co-untry of responding offices is not known to the WP leader or the research groups.

Before the questionnaire was sent to Interpol offices, it was translated into the four official languages of Interpol. Only information on the region of the world where the responding police offices are situated has been made known. The fol-lowing regions have been used to classify results:

• Europe (12)

• Middle East and North Africa (6)

• West Africa (2)

• East Africa (6)

• North America (2)

16 Authorities in Austria, Bulgaria, Germany, Italy, Norway, Romania, Slovakia and Slovenia. We received reply from two relevant Italian telecom authorities.

17 Austria 1 ISP, Bulgaria 6, Germany 1, Italy 3, Norway 1, Romania 1, Slovakia 1 and Slovenia 4 ISPs.

• Central America (4)

• South America (2)

• Asia (3)

• Oceania (0)

Figures in brackets indicate the number of replies from each region; 37 replies in total, constituting a response rate of approximately 20 %. The figures are of course much too low to give any representative picture. Moreover, the fact that country identity is hidden from the researchers makes it impossible to draw upon context and other information to do analyses of specific countries. Therefore, conclusions on basis of this material could only be made with great prudence and only when very clear patterns are identified; in particular when answers are more or less unanimous or when there are sharp differences. Even when general conclusions may be drawn, the nature of them will practically be that there are indications in a certain direction etc. Moreover, we are not able to explain what seem to be identified tendencies etc. In that sense, the results are more of a prelude to further research than final results.

2.2.4 General methodological considerations

Above we have emphasised some of the limitations of possibilities to draw ge-neral conclusions on the basis of the two investigations of WP7, and of combi-ning results from the two investigations. Notwithstanding this, and in addition to the concrete conclusions that may be drawn upon the existing material, the two inquiries have, in our view, proved fruitful to generate basic insight into the problem field. Examples from various countries – with known or unknown iden-tity – have been very valuable in developing general understandings of questions regarding use of personal location data etc. in the fight against crime, and appur-tenant privacy and data protection questions. Thus, one characteristic of the way we use results from the inquiries of WP7 is to extrapolate and suggest approac-hes and overall models to which all or most of our examples fit, and which thus should be tested as general vehicles for privacy and data protection authorities and advocates, as well as police authorities. Regarding these parts of the results, we refer to the sections titled “Concluding observations”. Some elements of such general insights are even placed outside concluding sections of this report but are nonetheless a result of the project. The models in section 3.1 and section 3.3 (below) are typical examples of such results.

(PT technology)

3.1 Introduction

This chapter aims at communicating some basic knowledge and insights regarding technological issues particularly relevant to WP7 of the RESPECT project, i.e. po-sitioning and tracking technologies, PT technologies. Our point of departure is a simple model which pictures main elements of the discussion in this report and places technological issues in the context of social effects and normative questions.

ICT tools (devices and software) in which PT technologies are imbedded

Use of ICT tools with PT functions by certain actors, for certain purposes Produced eﬀects of PT functions direct – indirect, expected – unexpected, social costs – beneﬁts

Le ga l norms / re gul a tion

Social and p ro fession al norms Ethi ca l norms

SocialﬁeldTechnologicalﬁeld

Normative ﬁeld

Basic PT technologies GPS, GSM, WiFi, WLAN, RFID

Figure 1 Overall model of technological, social and normative aspects of PT technology

The model consists of four horizontal layers, building from basic technologies to produced effects of ICT tools where these basic technologies are used. We have no strict definition of “basic technologies” and more examples than those men-tioned in Figure 1 could be added. The point is that these technologies are basic in the sense that they are/could be combined and integrated in ICT tools/devices and thus be part of complex technologies. The model is of general nature. Here, in the context of WP7, we have narrowed it by selecting special types of basic technologies which could be used to locate and track people and objects. The

smartphone is a good example of a device which combines and integrates several such basic technologies.

Technologists may have problems accepting our classification of some tech-nologies as “basic”. There are, of course, techtech-nologies on which GPS, GSM etc. are based which are even more basic.¹⁸ However, our point is only to – quite prag-matically – identify technological construction bricks for building advanced and complex ICT tools that may be applied to locate and track, not to tell the whole

“technological truth”.

The second layer in the model should be largely self-explanatory. It repre-sents devices/systems (hardware, software) in which basic positioning and track-ing technologies are combined and integrated with other technological elements and features. An important background for this is the experiences in TRANVIK (2013), and research on fleet management systems in the business sector. Here, we have seen a development from quite simple systems based on, for example, GPS for the purpose of tracking vehicles, to much more advanced and complex systems where tracking cars etc. is one of many functions integrated with back-office systems etc.¹⁹

We choose to denote the two first layers the technological field, among other reasons because we believe regulatory/normative strategies should be/must be/

are different in this field than in the social field, cf. next two layers. The layer “use of ICT tools” represents descriptions of actual application of the technology, an object of study enabled by describing functions, asking about purpose for use, etc. In WP7, for instance, we have mapped areas of application where location and tracking is a part (e.g. payment, access control, marketing etc., see sections 4.3, 4.5, 5.6 and 5.7).

The top layer in the social field is about the effects of PT technology use. We may talk about social (and other) costs, but also of various types of benefits – and of course effects which are hard to classify as “good” or “bad” (because people disagree, because “time will tell” etc.). Some effects can be directly and simply observed, while others are indirect and are often the results of complex synergies.

Many effects are anticipated, but because technologies will be introduced in many different and complex social patterns and processes, occurrences of unanticipa-ted effects should be expecunanticipa-ted. We may also make a distinction between intentio-nal and unintentiointentio-nal effects (which could be both expected and unexpected) etc.

The point here is not to present a complete inventory of social effects of ICT tools with PT functions, but to emphasise that it may be useful to have some common subcategories to introduce as starting point of analyses.

18 For instance microchips.

19 Tranvik (2013).

The second main element of the model is on the left hand side (vertical) and represents three normative aspects (“normative field”). The main point here is that every layer is/should be subject to some sort of norm system, be it ethical, social or legal norms. An important aspect is the interplay and synergies between dif-ferent types of norm systems. Choice of regulatory strategy should be based on knowledge of such normative interactions. Effective regulation would probably require different normative strategies on different layers. The overall question is of course: which normative strategies work if we want to protect life, health and property from criminal acts and at the same time safeguard privacy and legal protection?

Aspects linked to the social and normative field will be discussed in Part II of this report. The remaining portion of this chapter will be used to provide some fundamental information regarding the selected basic technologies that may be used to position and track objects and people (PT technologies). In section 3.2 we will first and foremost be on the first layer in the model presented above, but even some examples of more concrete application of these technologies will be mentioned (cf. second layer). Thereafter, in section 3.3, we will develop some general views on how PT technologies may be used to pursue the objectives of positioning and tracking.

3.2 Basic technologies

By and large, the very brief descriptions of basic technology in this section follow at least a common list of issues:

• What the technology does

• How the technology works

• Main cost elements

• Questions related to technological interoperability

The level of detail of our technological explanations below is low and adjusted to the purpose of our elucidation, namely to communicate the nature and potentials of each technology. To the extent that more in-depth information is required as basis of specific discussions later in this report, this will be given in that context.

3.2.1 GPS

The Global Positioning System (GPS) is a satellite-based navigation system that provides a receiver on the ground with location and time information.

The current system uses a total of 24 satellites (plus three spare) and 12 ground stations spread around the globe. To function, the receiver requires unobstructed

view to at least four GPS satellites. The system does not work inside buildings or in tunnels. The resolution accomplished with the current system is on the order of 10 metres (Kaplan 2005).

The current system is operated and maintained by the United States government’s Department of Defence. However, GPS is freely accessible and usa-ble by anyone around the globe with a GPS receiver. It serves both military and civil uses.²⁰

To remove the dependency upon the goodwill of the USA, other governments are developing alternative satellite based navigation systems, including GLONASS (Russia), Galileo (European Union), BeiDou (China), and IRNSS (India). These systems are still under development.

Since the non-US systems do not yet exist, there is no way of predicting the extent to which these systems will be interoperable with each other. However, the International Committee on Global Navigation Satellite Systems has expressed a strong commitment to interoperability²¹:

Interoperability refers to the ability of global and regional navigation satellite systems and augmentations and the services they provide to be used together to provide better

In document Use of personal location data by the police (sider 10-0)