Overview
Once data has been collected and filtered, it must be stored, tagged, and later removed or destroyed. This phase of the SIGINT process is particularly relevant for both oversight bodies and the intelligence services because lawful and efficient data management is the basis for relevant data analysis.
Bulk data processing presents several complex governance challenges that will occupy oversight bodies for years to come. There is plenty of room for oversight innovation.
When drafting intelligence legislation, lawmakers should be sufficiently mindful of the role and depth of multilateral intelligence cooperation. Services exchange raw and evaluated data in enormous quantities with their foreign partners and jointly feed various databases. Legal frameworks should account for the joint responsibility that governments have for joint databases, even if they are not hosted on their territory. Furthermore, there is a pressing need to ensure effective oversight of shared databases, possibly in the form of multilateral oversight.
Many oversight bodies seem to agree that much more work needs to be done to independently verify that the services honor their obligations to delete data. Drafting standards for what constitutes proper deletion and how this can be verified would be one important step in this direction.
Relevant Aspects
For the sake of clarity, this phase is divided into four subcategories reflecting the different facets of data processing: storage, maintenance, sharing, and deletion.
Data Storage
Due to different retention periods, it may become necessary to keep separate databases, for example for encrypted data, metadata, and content data, or in order to distinguish data pools according to their legal basis or warranted purposes. It can therefore be relevant whether there are isolated data storage locations. Increasingly, bulk surveillance governance relies on the verifiable technical or institutional separation between the authority to intercept and the authority to analyze the data. In order to honor data protection obligations, a surveillance law should further restrict the extent to which databases may be linked or accumulated.
Transnational threats prompt closer trans-border cooperation among intelligence services. Intelligence data – both unevaluated and evaluated – is therefore not just shared bilaterally, but also stored in joint intelligence databases for different threats and purposes. When we speak of joint databases, we refer to a multilateral exchange of data that can be hosted either on national territory or abroad. Typically, joint databases are run multilaterally, with all participating services adding and accessing data.
Data Maintenance
This comprises all practices that concern the labeling and registration of intelligence databases. Data upkeep is not only required by data protection regulations, but also serves a practical end: It ensures that the services keep only relevant and accurate data.
For auditing purposes, data must be traceable throughout the entire lifecycle. It is also important to anonymize data to the greatest extent possible. The security and quality of the databases must be ensured to protect the sensitive information from being stolen or compromised. Adequate data maintenance also builds on clear restrictions of data access. Access to the stored data should be regulated by law and restricted to specialized personnel only.
Data-Sharing
Sharing data with foreign services entails a responsibility to assess and mitigate the risk of misuse of the shared data. Although SIGINT burden-sharing among partner services is a common practice, what rules and procedures are in place to evaluate partner services’ data quality and data veracity? Oversight of – and accountability for – data-sharing agreements and joint databases must be ensured. Finally, in times of advanced joint intelligence databases, how do oversight bodies cooperate internationally to control the permissible use of international data pools?
Data Deletion
The proper deletion of data is an enormous challenge. “Deleting” a file typically only marks the space it occupies as usable. Until the disk space is overwritten, the data is still there and can be retrieved. To ensure that the deleted data cannot be retrieved any longer, the physical records on a storage medium must be overwritten with other data several times (minimum of seven times, as per the US federal government’s guidelines). Although there are technical means to ensure that deleted data is actually unretrievable, it seems necessary to develop more detailed standards for what constitutes the proper deletion of data. Errors in this process could result in millions of datasets being falsely stored for years.
Moreover, it is now also “more costly to delete data, than retain it.” Therefore, legislators have found it difficult to insert the proper legal definitions of public standards for what “deletion” or “destruction” of data means into intelligence laws. By extension, then, the deletion problem also becomes a veritable oversight challenge. This is because review bodies need accurate audit trails to be able to check services’ compliance with data deletion requirements.
There is also a need for better guidelines on what data should be deleted at what point in time. Storage periods address this matter and define maximum time periods for which data may be retained. With adequate normative criteria at hand, the services or the competent oversight bodies could, theoretically, also decide to apply a shorter storage period.
Intelligence law should outline specific and short retention periods, after which the data must be permanently and unmistakably destroyed. There might be special requirements for the deletion of large amounts of data.
It is also relevant how data destruction is documented and reviewed by the competent oversight body. For example, is stored data linked to specific warrants, and does it have traceable time stamps for full and proper deletion? Adequate records of the data destruction are also important for possible notification purposes.
Lastly, how are storage and deletion implemented in practice? Should intelligence data be stored in “clouds”? We can observe intelligence agencies’ close cooperation with commercial third parties, such as private cloud storage services. It must be ensured that such outsourcing – entailing the risk of shifting responsibility for a crucial phase of data processing to private companies – does not undermine democratic accountability and oversight.