* 36C3 preroll music*
Herald: Next is Bijan. Bijan. Bijan, I pronounce this. Pretty persian. Yeah. He's
an attorney, ein Rechtsanwalt it is called in deutsch, and he works for the Gesellschaft
für Freiheitsrechte in Berlin. If I'm right. Good. Give them a welcome.
applause, please. It's early in the morning. We're going to kick back here.
*applause*
Bijan: Early in the morning, only at the Congress you can call 12:30 early in the
morning, but it is. And, um, well, if you've ever sat on a plane and wondered
what the person three rows behind you is eating, whether they flying alone, whether
they have checked in their luggage or only hand luggage and what visa they were using
when they were buying their plane ticket, then you're probably a police officer or
should join the national police of any EU member state, because that is exactly what
the national polices in Germany and Austria and other Europeans member states,
Europe, member states of the European Union, can do. Thanks to the PNR
directive, which is the topic of today's talk. And we are going to talk and explain
to you what the PNR directive and the laws transposing it into national law are all
about, why this is problematic and what we can do and what we are actually doing
against it in order to stop it. And Walter will start off with a few infos.
Walter: Yeah. Hello. So firstly, I would like to introduce into Epicenter Works,
because we have already a history on bringing down data retention laws. So
probably you know us from our fight against data retention in Europe when we
still were called "AKA Vorrat Österreich". I am working for Epicenter Works on a
voluntary basis. And I would like to mention my colleague Angelika Adensamer
who did the main work on this for Epicenter Works. But she cannot be at
Congress this year. So, flight data. It is said, I've heard that at any given point
in time, one million people are on a plane in the skies flying around the globe. As
you can see here. And today, although in times of resource exhaustion, we should
talk about that anyway. I am convinced today we are talking about the data
protection issue about it. A big one. And we are talking about passenger name
records. So what is a passenger name record, anyway? A passenger name record,
as you can see here, is a data set compiled of 19 different data fields. So
you can get about up to 60 different data points on one single passenger on one
single flight. So, for instance, you have data in there like the first and second
name, address, but also other things, metadata. More important things, like the
means of payment you made, the point in time when you booked the flight and things
like that. And as a specific problem about it is that there is also a free text field
so airline employees can enter data there and which we cannot control. And
altogether we have a quite big data set of each passenger on each flight. So this is
common in the airline industry. But in 2016, the PNR directive came about. So
what is the PNR directive? It is a piece of European legislation , which was
enacted in April 2016. And when we have European legislation, it's important to
mention that it doesn't come out of the blue out of Brussels, but it is enacted
together with from the commission, the European Parliament and the council. And
the council are the governments of our member states. So we have to keep in mind
that member states governments, have a big say when things like this are enacted.
And it is a directive. And that means that every single member state has to transpose
the content of the directive into its national law. And this had to be done
until the 25th May of 2018. This was the the tenth transposition deadline. And for
instance, Austria and Germany made laws to transpose that into their national law. So
what had they to enact? They had to enact laws prescribing that all airlines have to
transfer data of all passengers, all passenger name records of every flight,
and they have to be pushed to a national police database. So unlike the telecom
data retention I already mentioned, the data is not kept where it where where it
is created. But it has to be pushed from the private sector, from the airlines, to
police database, databases. And the data retention directive prescribes that every
flight leaving or entering the European Union must be covered by that. But in
addition, every single member state also covered flights within the EU. So you have
we have the full take now. Flights within the EU as well as flights leaving or
entering the EU. And every single record of every single passenger of every single
flight is in a police database and will be compared with existing databases, for
instance, of known criminals or of stolen passports and the like. And they try to
find matches there. And what they are also going to do is matching with predetermined
criteria. So they will come up with flight patterns of known perpetrators, for
instance, when they booked a flight and so on. They will algorithmically try to find
patterns there, and then they will compare your flight passenger name records with
that data. And if you have a similar behavior, than a previous perpetrator,
previous criminal, for instance, then you're already under suspicion. And this
data in these databases are stored for five years and can be further used by
different law enforcement agencies. So that data is not only compared and then
deleted again. The storage time is five years and they do something called
depersonalization about six months after the data was created. But this is not in
any way an anonymisation, but they just remove some data and it can easily be
identified again. So the person the data belongs to can easily be identified for
the whole period of five years. So you probably asked yourself already: First, is
this effective? Well, this runs already since last year, so we have some data.
First, I will present to you the data from Austria. In Austria, we found out that
already until the 30th of September, 2019, almost 24 passenger name records where
forwarded to the passenger name unit at the Bundeskriminalamt and
11 900 000 thousand different people were subject to that. And of these, almost
24 000 000 passenger name records, the algorithms that checking against databases
already brought up 190 000 matches. So every single match,
every single output the algorithm has, must be checked by a human employee. So we
have sitting there people who have to check. Even this is not even the data of a
year. And they have to check 190 000 matches and only 280
of them are actual hits. So if a person checks what the algorithm outputs there,
then only in 0.15% of the cases the policewoman or policeman
come to their conclusion: This is actually relevant for us. And if you do the math,
this means that only 0.001% percent of all that 24 million passenger name data, your
data which is checked, actually leads to a hit. And we don't even know how many
actual false positives remain in these 220. This is only what the police will
inspect afterwards. So we have no numbers or results if they had actual
investigative results on that. But what we can say is that there are 21 employees,
qualified employees, working in the passenger name, Passenger Information Unit,
and this costs almost 2 million euros per year and only for checking that data in
the small country of Austria. And Bijan now will present to you the data in German.
Bijan: The number, the data of the big neighbor, because you said small country
Austria. In Germany the numbers are surprisingly similar. We also had - have
numbers up until mid of August 2019, and we have had almost 32 million passenger
name records checked, which generated automatic results of matches of about
240 000, which then were checked by 40 police officers and there remained only
910 actual hits. So the fail rate was 99.6% and 0.003% all PNRs checked led to
actual hits. And even of that number, just as in Austria, we are not sure how many
false positives remain. We know that there were considerably a considerable amount of
false positives. We estimate them to be in the hundreds. But the law enforcement did
not specify what actually, how many supposed positives remained, even among
the 910. And one of the results we know is that it led to 57 arrests. We don't know
for which crimes. We don't know whether these people actually committed a crime,
whether they were suspected for crime, whether they were just on a watch list.
But 57 arrests, assuming this is these were legitimate, this means that 0.0002%
of all PNRs checked led to an arrest. And if you try to to transpose this to other
situations in life, you could go to a to a market, to to some, uh, to some festival
or what not, and just ask randomly people, and you would probably have with a similar
probability, an arrest in the end at the end of the day. So if this holds that this
whole PNR processing holds is this effectiveness is the standard that we are
happy with, then you can easily take this to all other sorts of walks of life. And
this is true, in our opinion, a big problem, because it will lead to a digital
surveillance state, which is has come quite near with these new tools that the
PNR directive provide. What we've now just shown are the the automatic is the checks
against databases. That was the one thing that the PNR directive provides for. The
other one is the checking against predetermined criteria. And this is where
the voodoo kind of starts, because the idea that you can merely from the data
that is in the PNR, in your passenger name record, derive whether you are suspicious,
or dangerous even is, at least in our opinion, pretty much voodoo, and it has
serious consequences. And it might lead to automatic profiling affecting hundreds of
millions of people, possibly, because everybody is checked when they and when
they use a plane. Everybody PNR record is checked against these automatic , against
these predetermined criteria, and not just for crimes such as terrorism or organized
crime, where you could maybe make a case that there exists such a thing as a
pattern of movements where you can identify a terrorist suspect, but it is
also used for crimes such as fraud or forgery or cyber crime where I would argue
you cannot find the typical cyber criminals flight pattern, flight patterns.
It's just not possible. And so but but the PNR directive itself is only the one
thing. We are fighting this for reasons that go way beyond the PNR processing so
the processing of PNR flight data, because it may set a dangerous precedent for other
mass surveillance. Already now PNR processing is being discussed for buses
that cross borders, for ships and trains. And there are some countries such as
Belgium that have already enacted the very much. And why stop there, might a police
officer argue. Why not include rental cars that cross borders? Why not at some point
include private cars that cross borders? Why not get away with that requirement of
crossing borders? Why not have everybody checked all the time, maybe via their
mobile phones? So when we give way to this sort of data processing with such a low
threshold of effectiveness, we open the door for all sorts of, um, of activity
that at least from our point of view, is illegal. And the question you were maybe
asking yourself or maybe not. Is this legal? We are convinced it is not. And
luckily, we could rely on a legal opinion that the European Court of Justice ECJ has
rendered a two and a half years ago. There is one PNR agreement in place between the
EU and the USA, which has not been challenged yet. And another agreement was
supposed to be known or was negotiated between the EU Commission and Canada, and
the EU Parliament then presented the question to the ECJ whether this agreement
would be violating fundamental rights of the Charter of Fundamental Rights of the
European Union. And the ECJ concluded that it would, in the form that it was proposed
to it, breach Article 7 and 8 of that charter's. Article 7 as the right to
privacy in Article 8 is the right to have your data protected, your personal data
protected. And we are, of course, relying heavily on that, on the arguments that the
court developed and developing them even further, because; as you can imagine, the
PNR, the agreement with Canada and the PNR directive are quite similar. So what are
these arguments that we are bringing up? And we've shown already that the
effectiveness is highly doubtful. And this leads us to concluding that the PNR
directive is disproportionate. So it violates human fundamental rights. For
several reasons. One being a point that we've both raised already that PNR
processing indiscriminately affects all passengers. And this is a very important
point, because it makes it shows the difference between PNR processing under
the PNR directive and what was formerly the the data retention of
telecommunications data. Because the latter would require a specific case,
something must have had happened in order for the law enforcement to ask for the
telecommunications data of the telecommunications provider. But our
PNR data on flights is checked all the time, always, against databases, and even
more importantly, the predetermined criteria, which we, of course, do not know
nothing about. And this brings with it especially the last point, the
predetermined criteria, are high risk of false accusations. We've already seen that
99.6% of data base matching, automatic data is matching is wrongful. And imagine
how much higher the number would be with checking against predetermined criteria.
And that the reason why we expect many false accusations, false positives, is the
so-called base rate fallacy, which basically says that when you're looking
for a very small amount of people in a large dataset and you have a significant
fail rate, you're very likely to produce more false positives, maybe many more
false positives than true positives. So actual suspects, or not suspects, but
actual terrorists. So, for instance, when you if you're checking 100 million flight
passengers. And you're looking for 100 terrorists, and you have even a fail rate
of 0.1%, not the 99.6 that we're talking about now, but even just 0.1%, this would
render this would this would render 100 000 flight passengers subject to to
to being suspected terrorists. So you would have 100 000 false positives, 100
terrorists that let's assume all of them so that they had a positive success rate
of 100 percent identifying positively as a terrorist suspect. Then you will have
100 000 false positives, 100 people that are correctly suspected. But everybody, of
course, will be treated the same. And what I've listed here are just the obvious
things, stigmatization at the airport by interrogation, searches of luggage of
people and arrests, missing flights. And depending on the country
you're in you may be in much more trouble after that. The second point is that the
data is being stored way too long. As Walter has already mentioned 5 years. Why
do you need 5 years worth of data to check a database entry or against a
predetermined criteria? Of course, you don't needed it for that. Because you
could do that immediately after a person has boarded. You can perform the check and
then you could get rid of the data, delete it after it's being used. The reason why
they're storing it so long as that law enforcement and intelligence agencies have
an interest that goes beyond that checking after boarding, they want to keep the data
and check it in future, criminal investigations in future, looking into a
person, what where they've traveled and so on and so forth. But that has nothing to
do with the original purpose of PNR, the PNR directive. And what at least everybody
here will know in all data storing, so data storing is in itself a problem. It's
in itself a violation of fundamental rights when there is no legitimate reason
to do so. But also all data storage puts the data stored at risk. And as we've
mentioned already, there's the payment data, especially there's other other
sensitive data with whom you've traveled, whether you've traveled with light luggage
or not, where you have gone to, via which place and so on and so forth. Another
point, which is a bit more complicated is that the director does not sufficiently
differentiate between crimes where automatic profiling could make sense and
others. So as I have said, there may be a point in saying that the typical
terrorists would fly from A to B via C without checking in luggage using this or
that tourist office and so on and so forth. So maybe just assume that this is
the case. This, no one can can tell me that there is a typical flight pattern of
a fraudster where you could ask someone define which way a fraudster typically
flies and identify such a person. So what the directive would have needed to do if
they wanted had wanted to check against predetermined criteria would have been to
identify for which crimes - exactly, and only for these - you can use such a voodoo
miracle weapon. And finally, these are not the only arguments, but the more most
important ones. We expect that the false positives especially will lead to
discrimination against minorities. And one example that the German National Police,
the Bundeskriminalamt has given us for a predetermined criteria are young men
flying from airports from the south of Turkey to a major European city. So
they're thinking about former IS fighters, IS terrorists. And as you can easily
imagine what kind of people will be sitting in in in a on a plane that's
coming from the south of Turkey to Germany or to any other European country. Of
course, this will affect them disproportionately, affect minorities. And
it is already now highly intransparent what how these these predetermined
criteria are developed. And imagine a near future where law enforcement will
naturally try to involve artificial intelligence and finding patterns in the
raw data of flight movements of PNR data, of the treasure they're now hoarding with
a five year worth of data. And at the latest, at that point in time, it will be
impossible for us to understand why a certain criterion was defined and how how
to challenge it when you're in the position to be arrested at the airport,
for instance. So what can we do? And that's where we come in. The two
organizations that we are. We are no typical advocacy organizations, but we do
strategic litigation. Because unfortunately no advocacy worked on the
PNR directive. It came into force pretty much as the, um, as national law
enforcement wanted it to be. And so there is one instance, one authority at the time
that in Europe, in Germany, in Europe, the European Union, the courts, which can
which can ideally, um, dismiss of the reasons of the motivations of law
enforcement to have such a directive enforced and can try to objectively assess
whether this is actually legal and should remain in force, stay in force or not. And
we did this through litigation both in Germany and in Austria, and both are
having the same goal, which is to present to the European Court of Justice the
question whether the PNR directive and any national law that is transposing the PNR
directive is in violation of the Charter of Fundamental Rights. Why do we have to
go? Why is the ECJ important? Because when you have a national law that directly
transposes a European law, a directive, then then only the ECJ can declare such a
law void. There is no way for, for instance, in Germany, the federal
constitutional court, the Bundesverfassungsgericht, to say that this
law should not be applied any longer. This question must be presented to the ECJ. So
how could we get to the ECJ? This actually was a process that took us quite a bit of
time. It's been two years in the making. A year ago, we launched six different
complaints of six different plaintiffs that are flying all over Europe, that we
booked flights for them that led them to a European member states, a European Union
member states and two states outside of the European Union. And we sent the
complaints to three different courts. The one, two complaints were directed against
the German national police and went to the administrative court in Wiesbaden, and
four others were directed against the airplane airlines. So we tried to
diversify as much as possible in order to find a judge that would agree with us that
this is problematic and this needs checking. And we are optimistic that
either the court in Wiesbaden or the court in Cologne will soon present these very
questions to the court, whether the German transposition law and the PNR directive
itself are violating fundamental rights after European of the Charter of the
European Union. Walter: So as Bijan already mentioned, our
aim is to bring our case as quick as possible to the European Court of Justice.
So we had different options. And in Austria, we went a third way. We brought a case
before the Austrian Data Protection Authority against the Fluggastdatenzentralstelle
im Bundeskriminalamt, a passenger named unit. And we we brought several
different cases and we also found out that different, smaller things which we are on.
But the main thing is that this case already went as planned to the
Bundesverwaltungsgericht, so the federal administrative court in Austria. And from
there, we hope that is also soon forwarded to the European Court of Justice. And
theoretically, it would be enough if one case hits the European Court of Justice.
But practically, it is, of course, very important to have different strategies
because there are different speeds and so on. So that's why we also should mention
another case, the the Belgian case. So this Belgian human rights organization,
they also brought the case before a Belgian court. In this case, it was
directly the Belgian constitutional court. So they had a direct way to the
constitutional court, unlike our cases in Austria, where this or in Germany where
this was not possible. And therefore, the Belgian constitutional court already
referred this case to the European Court of Justice. And we are hoping that our
case will be soon or cases, or at least some of them will soon be joined with this
case at the European Court of Justice, and then decided together. So to sum up, we
have actually a very infringing piece of legislation the PNR directive, PNR
processing, as Bijan explained to us in more detail, is extremely intrusive in all
flight passengers' fundamental rights. It violates fundamental rights, especially
because it is already... is also ineffective and disproportionate. So we
heard about these different things. The base rate fallacy that it is ineffective
and disproportionate because it is not really possible to find specific suspects
in such amount of data with without having a lot, a real lot of false positives. So
other arguments are that it is data retention in the first place. So also
already the retention of the data of people like you and me is a big problem
and unlawful. And this general suspicion it leads to. So everybody becomes a
suspect and can become practically a suspect, can get problems practically from
that legislation without being a criminal. And yeah, we have strong arguments as we
showed you already, the case of the Canada PNR directive, the PNR agreement with
Canada is very similar in practice to the PNR directive. So the arguments already
held before the European Court of Justice. So actually, it's a shame that this was
not stopped earlier. And civil rights organizations as we are have to do that.
And that's what we do. And that's also why we depend on donations. So that's also
important to stress that our work people having people fully employed to do things
like that cost some money. And that's where you can find us. So we have a
campaign website, nopnr.eu in German and English. And you can find us, of
course, on our website and both websites and find ways how to join us, how to
support us. And also still today, you can meet us at our assembly in the CCL
building the about freedom assembly, where both the Gesellschaft für Freiheitsrechte
and Epicentre Works have their desk and you can ask all the question. But first,
ask all your questions now. Thank you.
*Applause*
Herald: Thank you, Walter and Bijan, for this very clarifying statements. I suppose
there are quite some questions here in the audience. Only I'm looking at someone
who's grabbing a microphone now. I see the signal angel. Yes. The mic is not on. Can
someone help him? Signal Angel needs a mic. Yes, it's almost there. Brains are
working. Signal Angel: Thank you. Is there a cheap
method to spam for some trees, for example, by booking flight under a false
name and then canceling the flight? Bijan: Well, I think it's it's difficult
to say. I didn't get the very first words. Sorry.
Signal Angel: Yes, the very first one was: is there a cheap method to spam, to spam
for some trees? Bijan: Yeah. Theoretically, I don't think
that anything could speak against that. Yeah, but the problem is that you would
need to cancel very late because, um, I think the first time they push the data,
the airlines are pushing the data to the national police is, 48 hours before the
before boarding. So that might come to become a bit expensive.
*Laughter*
Walter: I would want to make a general remark also on that. Of course, here,
especially here, thoughts like that, how to hack the system are very important and
can help. But our general approach is to take legal action to protect all people at
the same way, and not only those who who are able to protect themselves or hack the
system or whatever. So that's the reason why we both go this general way to bring
that down. Completely. Herald: And other question here. Yes.
Sorry, sir. Please. Q: What do you expect as a result of your
litigation if you are successful in court? Will ... do you expect the courts to
strike down the directive entirely, or do you expect another legislative process to
do the same thing again or to fix, quote unquote, the directive in very small ways
just to to drag out this battle and continue the practice. What do you think
the effects will be? Bijan: Well, we think that the European
Court of Justice, if it follows our argument, our reasoning, it should it will
strike down the PNR directive entirely, because the way it is set up is
fundamentally not in in accordance with what it earlier ruled so far. Unless it
will change its its entire history of ruling on data retention and so on and so
forth. But of course, we will expect the member states to push for another
legislation that may be similar, but not the exact same thing. So I can imagine
something of a of the sort of data retention of telecommunications, as it
were, and with airlines retaining the data and keeping it for a shorter period of
time and only giving it out when there is a specific request with, where there is a
specific reason for law enforcement to ask for the data. I could imagine such a thing
coming up again and then we would need to check whether this is illegal or not. And
maybe go through the whole procedure as well. But it is it would be an immense
success if the PNR directive as it stands would be void. Declared void.
Herald: Thank you. Someone else has a question. I see the person here.
Microphone one, please. Q: Hel-lo, yeah. Okay, so you had the
agreement that, uh, there are a lot of false positives when they checked up PNR
data. Um, do we have any information how long it takes for them to react on the PNR
data if they get a positive hit? So maybe they won't react after the person has
landed and already, uh, is in the country? Bijan: They claim that they can act
immediately, but we can't know that for sure. So the fact that they had 57 arrests
at the airports signals that at least that in some respects this is true. But we
cannot know for sure how much, how quickly they they they kind of react. And keep in
mind, this is only the start. So, so far in Germany, right up until the point where
this the data that I presented for Germany came about, there were only 9 airlines, I
think, that were linked to the system. So expect there to be much more data coming
in. And once they start with a predetermined criteria thing, this will
multiply probably. Um, even so, I cannot imagine unless they they ... have this
new, um, thing with hundreds of people involved that they can act immediately in
each and every case. Herald: Thank you. There is a question
again on the Internet. Yes. Signal Angel: Yes. How come, you haven't
tried voiding the local at one provisions that this PNR there for intra EU flights? *(???)*
That seems most likely against Schengen provisions.
Bijan: We have addressed that as well. We have picked intra-EU flights also. We have
not just picked flights that go extra EU, but, we've also made the point about the
the violation of Schengen criteria. But that is not so much that is not the focus
of our argument because they are, in our opinion, much stronger ones. Because with
Schengen you would need to argue that it's practically impossible to enter the
country without being held up and you're not being held up in a physical form, at
least not in general, generally. And so this argument is a bit more difficult than
having an actual border checking of people. But we're making this point, of
course. And but we rely on other points that we think are stronger.
Herald: Okay. Please. Microphone number one, please.
Q: Is there also data being collected on flights inside a country. So, for example,
from Munich to Berlin. Bijan: Not yet. Not under the directive.
And theoretically, of course, that the German legislator or any other legislator
could decide to include that as well, but not so far.
Herald: Number two, please. Microphone. Yeah.
Q: I was wondering how much, uh, false negatives are in there. You know, that,
like, uh, these big databases. If I don't act like a normal terrorist or something
than I am? Bijan: We don't we don't know,
unfortunately, not yet. Um, I did. I think it would be very interesting, especially
for the predetermined criteria , to see how many they miss. Um, but yeah. No, not
nothing at. Herald: Yeah, and there is no undo button,
I think. No. No. No undo. That's always the thing that I that I'm worried about,
you know. Then you have an announcement about France's data that go out and then
you can't have an undo. So what do we do then? It's always new. Yeah, you can keep
this for five years now. But who says it's there for five years and what kind of
interpretation to get out of it for five years? After five years?
Bijan: You can't know in which database you will be transferred in
the meantime, because law enforcement can access the data of that very data set and
forth for that data and the PNR data set and put it in another data set because
they have whatever reason to do so. And then these are again enlarged and
enlarged. And then you will find another reason why they should remain in there for
a longer time. So, yeah. That's why we're fighting this now and hoping to change the
future. Herald: How do you see your chances?
Actually, uh, a long term or short term chances to get to that point is that?
Bijan: We are very convinced that we will be successful, because otherwise we
wouldn't have started this. This is one of our principles. We only do things that we
are convinced of being able to win and we think that we will win this. And what will
come out of it? Referring to the I think the second and the second question
earlier. And what will be happening in the future with other legislation? I can't
know. But one argument the police is always making or in private, at least to
me, are is that they're saying, well, people will get used to it and it won't be
in in five or 10 years. Nobody's gonna be wondering about things like this. And this
is exactly what we are working against, that this never becomes normal, because if
this becomes normal, as I've argued before,
*applause* Herald: needs an applause Yes.
Bijan: If it becomes normal, as I've argued before, it is easy to extend it to
all sorts of life and ways of life and walks of life. And this then would be in a
surveillance state par excellence. Herald: We were very close there. So we
need to support them really hard. There is one last question I suggest. No. There is
two questions. Number two. Yes. Q: Does the PNR directive apply only for
regular scheduled flights? So does it also apply for private flights? The general
aviation business flights, etc.? Bijan: Good question. I don't know.
Actually, I look into that and. Write me! Come, come here later and I'll check and
I'll give you an answer. Herald: Then there is one at number one.
Q: I just wanted to ask a question in response to the idea that this is becoming
very normal, because one thing that I think has become very normal that hasn't
been mentioned explicitly is the idea that people can be essentially put on a watch
list as being a potential criminal in the absence of a crime. And we have these
terrorist watch lists all over the world now. That is now the new normal. And I
think that's very problematic. And can you just maybe talk about: Do we, do you see a
future where we can actually get back to, you know, only arresting or investigating
people because of probable cause, for example?
Bijan: Oh, I hope that this will be our future. But, uh, about that point, that
very point, I'm not too optimistic, to be honest. I am optimistic about one other
one. Another thing that is that these instruments that are now being created
will prove to be highly ineffective, as we've so now see now already with checking
against databases, that is already a lot of work and very tedious work. But with
the idea that you can define criteria for people that that are legitimately to be
suspected of committing a crime in the future, I think it will prove, at least
for the next few decades, to be quite impossible. And this is I don't know if
this came across correctly sufficiently, but this is really the core issue that we
have with the PNR directive. They are claiming that they can find suspects of
crimes or future crimes. Imagine! Not not someone that has committed a crime or that
will definitely commit a crime, but that can reasonably be suspected of committing
a crime in the future, and then act upon that. And that is really a huge step into
what I called voodoo, about the expectation that you can take data and
prevent crime. Minority Report times. Yeah. To the power five. I don't know.
Herald: Sit back and relax. Thank you Bijan and thank you, Walter, for this
fantastic lecture. Please support them at noPNR dot EU, go to their booth as well.
And thank you all.
*36C3 postroll music*
Subtitles created by c3subtitles.de in the year 2021. Join, and help us!