Signals intelligence

Questions and answers on signals intelligence

Why is there a need for signals intelligence?
" Information collected via regulated signals intelligence is necessary for Swedish foreign, security and defence policy.

" We want to have a strong, modern defence that can meet current threats and that safeguards Swedens security and territorial integrity. Regulated signals intelligence is an important element of this.

The threat to Sweden is no longer about a risk of invasion by another state. Instead, threats come from disintegrating states and regional conflicts, terrorism and the threat of the proliferation of weapons of mass destruction. They are also about IT attacks that are carried out in order to paralyse parts of, or entire societies. We need, as far as possible, to learn about and prevent such threats. Because of these threats, a well-functioning intelligence system with the right tools continues to be necessary. Sweden has been conducting signals intelligence over the airways since World War II. The monitoring of these communications has been entirely unregulated. Previously almost all communication was transmitted over the airways. Today, it is estimated that 95 per cent is transmitted by cable. This is why we need regulated signals intelligence.

The purpose of the Act is to create the conditions for signals intelligence in defence intelligence operations to contribute to Sweden's security in the future as well. To be able to continue to do so, signals intelligence must also be able to be conducted via cable. Up to now, it has only been collected over the airways, i.e., targeted at radio signals. An increasing proportion of international traffic, where the interesting information is found, is now transmitted by cable. This requires technology-neutral legislation that regulates signals intelligence for these new channels of communication. It is thus a question of whether we are to retain our ability to collect information. In addition, we need to introduce strong protection for the individual's privacy and more clearly regulate the basis of signals intelligence.

Up

What are the main arguments as to why signals intelligence is necessary?

1. During the entire post-war period, signals intelligence has been collected without being regulated by law. This is unacceptable from a perspective of privacy. Because of this we are now introducing more stringent control functions to protect personal privacy and to regulate these activities by law. This means that, as of now, we will also be able to collect intelligence via cable, at the same time as all intelligence collection will be clearly limited to foreign matters.

2. It is important that we have effective signals intelligence to enable us to rapidly obtain information if the threats to Sweden should change. Signals intelligence is important to be able to meet external threats to the country. These may involve a military attack, cross-border terrorism, an IT attack or the proliferation of weapons of mass destruction.

3. To secure Swedish independence in foreign, security and defence policy issues, we must be able to obtain intelligence on the situation in the surrounding world on our own. If we cannot collect this information ourselves, we cannot obtain information from others either.

4. For signals intelligence to work in the future as well, it is not sufficient to collect information via airborne signals. We must also be able to monitor information transmitted via cable over the countrys borders since it is there that we can obtain information on threats.

Up

Who conducts signals intelligence?

The National Defence Radio Establishment (FRA) conducts signals intelligence. Intelligence is collected in an automated way with the help of different search terms. The FRA is a civil agency and not a military agency, as has sometimes been said in the debate.

Up

What will happen now that the Riksdag has approved the Signals

Intelligence Act with certain additional provisions on 18 June?
The Ministry of Defence is now working to fulfil the provisions that the Riksdag instructed the Government to include. This work will be completed before the FRA gets access to traffic in cables on 1 October 2009.

Up

What does the Signals Intelligence Act adopted by the Riksdag on 18 June mean?

The Act means that for the first time, Sweden is setting up clear regulations for how signals intelligence is to be conducted. This Act provides strong protection for peoples personal integrity, which was previously not the case.

The Signals Intelligence Act does not entail any new tasks for the National Defence Radio Establishment (FRA), but regulates current intelligence collected over the airways while also enabling the FRA to collect some intelligence via cable. In several respects in fact, the Act will lead to restrictions on the FRAs mandate compared with the situation today.

Up

How is the protection of peoples personal privacy ensured?

There are several strong control mechanisms and functions that guarantee that signals intelligence is conducted in compliance with the Act.
" It may not apply to a natural person only.
" It must be proportionate to the purpose stated.
" It must be clear that the information cannot be collected in a manner that is less intrusive on privacy.
" In addition there is a clear dividing line with regard to police operations, for example.

Up

It is said that privacy protection has been strengthened by a number of amendments to the original draft act. In what ways?

Since the original draft was referred for comment in 2005, the following provisions or clarifications have been added:
1. clarification that the Act only permits signals intelligence for defence intelligence purposes.
2. all signals intelligence requires directions by the Government or a government agency.
3. search terms are to be designed and used in such a way that they cause as little infringement as possible upon people's personal integrity.
4. a Government decision on the direction is to be preceded by consultation with the Swedish Intelligence Commission.
5.a direction on signals intelligence may not apply to a specific natural person only.
6.permits for the direction of the signals intelligence are to be temporary.
7. permits may only be granted if the purpose of the directions clearly outweighs the infringement upon personal privacy.
8. permits may only be granted if the purpose cannot be fulfilled in a less intrusive manner.
9. legal regulation of the fundamental structure (similar to courts) of the permit-issuing body.
10. legal regulation that the permit function must be independent of the FRA.
11. the obligation to destroy data also includes messages between a suspect and his/her defence lawyer.
12. an explicit right for the control agency to cease collecting intelligence and to decide on the destruction of what has been collected.
13. legal regulation of the structure of the body that will make decisions on ceasing to collect intelligence and on the destruction of the data.
14. specific rules prohibiting the reporting of surplus information on private people.
15. a Privacy Protection Council will be established within the FRA.
16. clearer dividing lines between police operations related to crime fighting.
17. more detailed provisions on the purposes of signals intelligence within the framework of the legislation.
18. more detailed provisions on how applications for permits should be designed.
19. more detailed provisions on how the destruction of recordings and records is to be implemented.
20. the establishment of a new board that is court-like in character for consideration of permits.
21. the requirement for a permit for use of search terms that are directly attributable to a natural person in Sweden.
22. the requirement that the Government and Government Offices take account of privacy when deciding on directions.
23. annual reports from the Government to the Riksdag.
24. reporting in a review in 2011.
25. The Data Inspection Board will be instructed to monitor the activities of FRA up until the review of 2011 from a privacy protection perspective.
26. a reference group with people proposed by the parties in the Riksdag will be linked to the Data Inspection Board.
27. a parliamentary committee will be appointed, tasked with monitoring the FRA's activities until the review.
28. the parliamentary committee will appoint a privacy representative tasked with monitoring permit issue and safeguarding privacy for people in Sweden.

Points 1728 include the assignment that the Riksdag gave to the Government when the Act was adopted on 18 June this year.

Up

Does the new Act mean that the FRA is allowed to pursue active signals intelligence and hack its way into computer systems to obtain information?

No, the Act does not permit the FRA to hack its way into a computer system. The Signals Intelligence Act clearly regulates the FRA's ability to collect traditional signals intelligence over the airways and by cable.

The Signals Intelligence Act does not entail any new tasks for the National Defence Radio Establishment (FRA), but regulates current intelligence collection from over the airways while also enabling the FRA to collect some intelligence via cable. In several respects in fact, the Act will lead to restrictions on the FRA's mandate compared with the situation today.

Up

Will domestic traffic be subject to signals intelligence?

Domestic traffic is transmitted without the person communicating being able to influence how this is done. Operators usually choose the cheapest route, which can lead to domestic traffic crossing back and forth over the country's border. This is why, in purely technical terms, the possibility of domestic traffic becoming available to the FRA cannot be excluded. This does not mean, however, that these communications can legally be collected. Only information concerning cross-border situations may be collected, and this also requires that the traffic is relevant for Swedish foreign, security or defence policy or for identifying external threats to the country.

If traffic concerning purely internal matters should nevertheless end up in the FRA system, there are clear provisions on the destruction of communications that are of no relevance to the purposes of signals intelligence. Crossing the border does not mean that the FRA intercepts the traffic automatically. The FRA is instructed only to intercept communication concerning matters of interest to Swedish foreign, security or defence policy or external threat to the country within a clearly defined framework and using specific search terms.

Up

How will the FRA's signals intelligence work be controlled?

This control will ultimately be undertaken by the Swedish Intelligence Commission which will check that the signals intelligence is collected for the purposes stipulated in the Act, i.e. that it concerns cross-border situations of interest to Swedish foreign, security or defence policy or represents an external threat to the country. The Swedish Intelligence Commission will be authorised to immediately stop ongoing signals intelligence and to decide on the destruction of material if it emerges that the surveillance is being conducted in a manner that contravenes the regulations.

A permit is required for an agency to be able to instruct the FRA to collect signals intelligence. A judicial board that is court-like in character will be established to be responsible for consideration of permits. This permit will be temporary.

According to an assignment given by the Riksdag in connection with the passing of the legislation:

" A Privacy Protection Council will be established at the FRA consisting of members appointed by the Government who will thus be independent of the Agency. The Council will be responsible for monitoring activities from the inside.

" The Data Inspection Board is already responsible for controlling the processing of personal data undertaken by the FRA. The Data Inspection Board will be assigned a special task of monitoring activities from a privacy protection perspective and will then be represented by a reference group consisting of people nominated by the parties in the Riksdag.

" A parliamentary committee will be appointed to monitor activities until the review  evaluation  which will take place in 2011. The committee will appoint a privacy representative, who will be present when permits are under consideration.

Up

Can the interest in fighting crime justify far-reaching infringements of privacy?

Signals intelligence is independent of the Swedish Police Service. The purpose of signals intelligence is not to prevent or fight crime, but to support Swedish foreign, security and defence policy and to identify external threats to the country. It is thus Swedens security that is at issue.

Up

What happens if someone's communication is incorrectly intercepted?

The FRA may only process personal data if this is necessary for defence intelligence operations, i.e., to support Swedish foreign, security and defence policy and to identify external threats to the country. To otherwise process personal data is punishable by law and can lead to liability for damages. If the personal data processed is no longer needed, it is to be eliminated from the records. This will be checked by the Data Inspection Board and the Swedish Intelligence Commission.

Up

Does the Signals Intelligence Act entitle the FRA to be party to all cross-border email traffic?

No, the FRA is only permitted to collect information that is relevant to defence intelligence operations. This means that the information must be important for Swedish foreign, security and defence policy or for identifying external threats to the country. Only information concerning cross-border situations may be collected.

This is guaranteed through the fact that intelligence may only be collected via previously established search terms. It will not be possible for anyone to "be party" to the information collected until this automated selection has occurred. Only information identified by the search terms may be stored. The search terms consist of a number of mainly technological parameters and not of plain language terms such as "bomb"

" Regulated signals intelligence can be likened to a small traffic control on a busy motorway, where only cars that, in different ways, can present a danger to the safety of others can be noted down and checked. Other motorists can calmly continue on their journey.

Up

Published 10 September 2008
Last updated 10 September 2008