Blogaria

[The EU] are contemplating requiring all 27 member states to collect data on airline passengers and to retain it for up to 13 years. [...] The proposal is part of an anti-terrorism package that also includes tighter laws to control hate speech and bomb-making instructions.

I find such news bits somewhat scary. Actually I find them very disturbing. For me, this is first of all an invasion of privacy. This privacy argument is unfortunately quite hard to explain to others. The counter-argument that is presented most often, is: "Why would you oppose? If you have nothing to hide, then this shouldn't bother you, should it?" My gut feeling however says something different: Why should anyone care where I travel and when?

But I think that there is an even stronger argument why one should disagree. Twelve years and 364 days from now, the European Union states will be able to check today's flight plans. Here's what bothers me.

• I am to assume that the retaining of data will be in good trust, aimed at preventing terrorist attacks.
• I am to assume that the retaining of data will not be aimed at good citizens to e.g. see if they travelled to their secret lover or to get some cheaper Wodka.
• I am to assume the retaining of data will not be aimed at checking whether I might've flown to some medical facility in say Spain, which might indicate that I have a higher health risk of something or the other, which would mean that my health insurance policy might need reviewing. Or in the same vein, European governments will not check whether I've flown to some political meeting of some movement which is currently considered harmless, but which is frowned upon ten years from now.
• I am to assume that the retaing of data will not be aimed at collecting commercially valuable data that can be sold to airlines for a few quick euro's.
• I am to assume that during this whole period, my data will be rigorously protected and that no breach of privacy, leading to e.g. identity theft, will ever be possible. Meaning that:
  • The EU will make sure that only properly trained and supervised personnel will manage such data. The people around the data will never ever be morons who leave e.g. back up tapes in their car. Furthermore they will never ever be susceptible to bribery, nor will they ever be otherwise criminally inclined which might also lead to the sell out of my data;
  • The EU will make sure that the technological level of security is always higher than the one of potential attackers. The EU can guarantee that no technology will be developed between today and 13 years from now that could crack the security systems protecting my data.

Sorry, that's just asking too much. This regulation forces me to put trust into the European governments not just in the present time, but also in the future. Why should I concede that I will trust the government of any (European) state thirteen years from now?

How can any organisation demand today that I should trust in them in the future?

Also I wonder whether anyone has actually verified that storing passenger data prevents hate speech and terrorist attacks. I strongly suspect that the decisions are made by the people who have the time, not the people who have the talent. And of course by politicians who act on a knee-jerk reflex: "Let's put some kind of measure in place, it'll make the public will feel safer." Does this mean that the decision makers think that no-one will bother to check whether the measure actually makes sense? Decision makers wake up! We're not a flock of idiots, stop treating us as such!

Incidentally, did anyone ever bother to go over the numbers? The Dutch airport Schiphol (the largest one in the Netherlands) currently ferries some 43 million passengers per year. So only for Schiphol we'd have 43 million records a year to check. The verification systems would of course be state of the art and highly accurate - but however accurate a system is, it always yields a given percentage of false positives ('hits' that initially ring a bell, need to be further investigated to determine whether they indicate a terrorist action, and -fortunately- in the end are found harmless).

What percentage of false positives would such systems yield? Ten percent? Five percent? Let's assume that the verification systems would be so highly accurate as to yield only one percent false positives. For Schiphol Airport only that would mean 1178 false positives a day!

What will we do to battle such ridiculously high numbers? We might expand the police force to cope with such numbers. How many extra officers would we need to check 1178 records each day? What would such an officer do, run back ground checks on the passenger? That way we could easily need 500+ extra personnel just to check Schiphol. Would placing an extra 50 trained guards in and around Schiphol be just as effective - if not more?

I'm sorry. The whole idea just doesn't make sense to me. Please convince me otherwise!