Finnish police seek authorization for data crime

To sum up what's happening over on my Finnish-language blog, just two months away from the next parliamentary elections, the Finnish government is seeking to give the police new powers to covertly break into citizens' computers and mobile phones.

The legistlative proposal for a new police law recently became public. In addition to existing wiretapping and covert surveillance powers, the police will be allowed to secretly install keyloggers or other technical devices, or crack telephones and computer systems remotely.

Although the new law will give the police increased powers to act covertly, it provides no real oversight or any opoprtunity for citizens to challenge the legality of covertly obtained evidence. In order to carry out a covert cracking operation, the police will need to seek permission from a court of law. Once the operation is complete, the police are required by law to inform the targets that they have been under surveillance, and the targets can then challenge the legality of the surveillance permit in court.

However, if the police fail to inform the target of the surveillance, nothing happens. As for the court challenge, there is already a decision from the Finnish Supreme Court that even if a surveillance permit was found to be unlawfully granted, evidence obtained in the unlawful investigation is still fully admissible in court. If a court is found to have granted a permit unlawfully, or if the police gave false information while appealing for a permit, no sanctions will be applied.

The law very specifically delineates what actions the police will be allowed to take under any given form of covert information gathering, and specifically what kind of information they will be allowed to extract. Permits must be sought based on the severity of the crime being investigated. However, the different forms of covert information gathering overlap and use similar methods. For example, if a suspect is being investigated for treason or a similar very serious crime, the police can obtain a wiretapping permit that allows them to listen to his telephone calls and read his e-mails. However, if a suspect is being investigated for any crime that happens on the Internet, such as a copyright violation, the police can obtain permission to crack their smartphone. According to the letter of the law, they aren't allowed to listen to his calls or read any of the "messages" stored in the phone. However, if they do, any evidence they obtain is admissible in court. If the suspect files a complaint, the maximum penalty (in practice) for the officers violating the law will be a reprimand.

In short, the bill provides the police with the authority to break into any kind of data systems covertly. The only judicial oversight consists of the police themselves reporting their actions to the parliament's ombudsman. Confusingly, this seems to be based on the idea that if the police break the law, they'll admit it in an official report.

So in practice, there is no oversight. The only recourse a citizen has is to appeal to the same ombudsman, who has few actual powers and less willingness to use them. Under Finnish law, basically any evidence, no matter how it's obtained, is admissible in court. This, combined with the lack of oversight, seems to present the police with a carte blanche to engage in covert surveillance of just about anyone they like.

Finland may not be a police state yet, but it looks like we're on our way there. Frighteningly, the parties currently in office are solidly behind this proposal, as it's being presented in the name of the entire cabinet. Their strongest challenger in the upcoming elections is running on a populist platform that includes harsher penalties for criminals. So not only are we on our way to becoming a police state, but no-one seems to care.