Dutch bill would let AIVD and MIVD tap a designated adversary for a year without pre-approval

The Dutch government has put forward a bill that would greatly expand the surveillance powers of AIVD, the domestic security and intelligence service, and MIVD, its military counterpart, with the main changes concerning surveillance and offensive hacking against countries designated as foreign adversaries.

Officials cited the threat of war with Russia and the increasing aggressiveness of countries like China and Iran as the main reason to overhaul the capabilities of AIVD and MIVD.

The bill is to be named the Wet bescherming nationale veiligheid door de inlichtingen- en veiligheidsdiensten.

The adversary designation is aimed at opponents of the Netherlands including countries such as China, Iran and Russia, and also organisations that undermine national security.

For the first two stages of hacking, approval from a supervisory body is no longer required; approval is needed only for the final stage, when the agencies copy data from a hacked system.

Both agencies gain a power to force Dutch companies or citizens to provide data on a target; those who decline can be charged and risk a prison sentence whose length is not yet determined.

Data held by online platforms and financial institutions can also be demanded under the bill.

Defence minister Yesilgoz-Zegerius said the change is necessary because of the speed at which Chinese hackers strike, using extensive digital infrastructure and switching servers quickly, and said the aim is to organise safeguards differently so the services can act faster.

The two current supervisory bodies are merged into a single new entity, the College van Toetsing en Toezicht (CTT).

The number of members involved in the advance review falls from three to two, there are fewer situations in which the services must seek prior permission, and the starting point is that one member takes substantive note of a tapping or hacking request.

The bill introduces a state emergency provision under which crucial obligations for the services lapse, including the duty to cooperate with investigations by the supervisory body, and it is unclear what situations would trigger it.

Bert Hubert, a technical expert and former supervisor, said the law is full of new powers and scales back review and oversight enormously.

Hubert criticised the public relations around the bill, saying the press release sells reduced control as new safeguards through a new college, and that this is not sincere.

The AIVD and MIVD will cooperate more with other parties, including the police, the armed forces, the tax service and the Financial Intelligence Unit Nederland.

The services will also share data with private parties, a development already under way in the United Kingdom and the United States and criticised there several times for inadequate oversight.

Substantive advance review of a tap or hack request falls from three members to one, a reduction of two thirds.

Interior minister Heerma said he does not see a danger in the emergency provision, that being a democracy with a rule of law and built-in safeguards is what distinguishes the Netherlands from its enemies, and that the law offers a good balance between the services' capabilities and oversight of them.

Volkskrant reports that in practice the changes mean more people will become targets of investigation by the intelligence services.

Ireland passed a new lawful intercept law earlier this year, Germany is a few steps ahead of the Netherlands in expanding its own intelligence laws, and France's planned overhaul appears aimed more at increasing internal surveillance than at targeting foreign actors.

Neither the Volkskrant account nor the Risky Business summary states how the expanded tapping power applies to traffic transiting Dutch networks, or whether interception at internet exchange points is in scope.

A single adversary designation covers up to twelve months of collection, so the authorisation decision is taken once per adversary rather than once per tap.

With Ireland, Germany and the Netherlands rewriting interception law in the same direction, spreading infrastructure across European jurisdictions converges on a single interception posture rather than hedging across several.