Data-driven Intelligence Oversight. Recommendations for a System Update

Abstract

Intelligence services around the world are driving the evolution of surveillance technology – a rapid, bold, and multi-faceted development. Many countries will run the risk of conducting irrelevant intelligence oversight processes if they fail to incorporate supervisory technology more systematically. The growing volumes of data used in the intelligence sector overwhelm the de facto guarantees of legal safeguards and effective oversight. Modern data analysis entails numerous risks in terms of data abuse and circumventing legal requirements. A lack of up-to-date tools, resources, and technical expertise serves to further undermine effective oversight. Oversight bodies need an update. They need to adopt tech-enabled instruments to respond to the technological advancements driving the intelligence field. Since key European nations are currently preparing new intelligence reforms, we hope that oversight bodies will embrace a paradigm shift from paper-driven to data-driven reviews. To advance this process, we would like to propose seven tools for data-driven intelligence oversight that should become part of a reform agenda across Europe. Each tool represents a viable solution to a concrete oversight challenge. Many build upon direct access to operational systems, which enables oversight bodies to conduct unannounced checks as well as (semi-)automated audits on intelligence agencies’ data processing. Some of our proposed tools are already being used by intelligence oversight pioneers, while others have been borrowed from good practices in other sectors, such as financial supervision and IT security. We invite policymakers, intelligence agencies, and oversight bodies to discuss these tools and develop context-specific strategies for data-driven intelligence oversight. In order to successfully implement these tools, we advise oversight bodies not to regard them as substitutes for traditional oversight mechanisms; instead, they should be viewed as necessary additions to existing toolkits and inspection processes. The hard work of improving oversight will require more than amending existing laws. There has been an overreliance on purely legal solutions to tech-inflicted challenges for too long. This report shows that legal requirements cannot be effectively enforced if the corresponding practical measures are not taken. A concerted effort is thus needed to identify better instruments that complement the legal frameworks and establish accountability.