|
Arsons investigations face major setback because of Vodafone and Go Mobile
Karl Schembri
Police officers investigating the string of arson attacks on the Jesuits, Daphne Caruana Galizia and MaltaToday editor Saviour Balzan among others, suspected to be fuelled by racism over the last year are facing resistance from Malta’s two mobile telephone companies which are refusing to pass over information about their clients indicating their whereabouts.
The investigators have been requesting Vodafone and Go Mobile for the lists of incoming and outgoing mobile calls, text messages and mobile signals captured by the two operators’ antennae in the areas where the arsons occurred since November last year.
But citing data protection regulations, the two operators are refusing to hand over the data to the police despite a ruling to do so by the Data Protection Commissioner, which was also confirmed by the data protection Appeals Tribunal.
The case is now in court, where the two companies are appealing the decision to release information, to be decided by Judge Philip Sciberras.
Known as location data, the information requested by the police would reveal the numbers of all subscribers who had their mobile sets in the vicinity of the arson attacks, as captured at the time by the mobile operators’ antennae, also called repeaters.
In fact the police have made specific requests by location and timeframes surrounding the individual attacks in a bid to trace the users in the vicinity and match them with other evidence, including closed circuit camera footage.
The arsons falling under investigation include the attack on the Sliema residence of Jesuit Refugee Service lawyer Katrine Camilleri last April, the attack on the Jesuit Convent in Birkirkara last March, the torching of columnist Daphne Caruana Galizia’s residence in Bidnija, and the attack on the residence of MaltaToday editor Saviour Balzan in Naxxar last May.
This is only the second time that Vodafone and Go Mobile are being requested by the police to pass location information about their clients, after a similar request was accepted in the investigation of the still unsolved murder of Gozitan lawyer Michael Grech.
The legal wrangle comes amid a global clash of values, pitting the protection of individuals’ privacy against what are deemed to be security concerns by enforcement agencies.
Traceability
The case also exposes, for the first time in Malta, the traceability of mobile phone sets by specific locations, thanks to signals sent constantly from every set switched on to nearby mobile phone repeaters mostly installed on rooftops or churches. Mobiles that are switched off are traceable to the last repeater capturing the signal.
Speaking to MaltaToday, Data Protection Commissioner Paul Mifsud Cremona said the arson cases “verged on terrorist attacks”.
“I gave the go ahead to the mobile telephone companies to provide the information after I made sure that the risks against individual privacy were outweighed by the seriousness of the crimes,” Mifsud Cremona said. “However I established a whole set of safeguards, especially that any information retrieved has to match the police investigations, the information has to be used exclusively in relation to this case, and that the data cannot be stored.”
In his reply to the court appeal filed last week, the Data Protection Commissioner describes the arsons as “a crime against Maltese society … aimed at, among others, seriously intimidating part of the population, destabilising the fundamental structures of society… by terrorising it.”
The companies are arguing however that the police requests are “blanket requests” that would effectively put all the mobile subscribers within the location of the arsons under suspicion – a claim to which the Data Protection Commissioner replied that police would anyway investigate and query all people on location in investigations even before they have reasonable suspicion in individuals.
The two mobile phone companies are declaredly championing data protection rights of their clients despite the Data Protection Commissioner’s go ahead, in what is effectively a costly retrieval exercise which Vodafone and Go Mobile would prefer to avoid.
The commissioner in his reply said that while in the Michael Grech investigation the mobile operators complied “without creating fuss about the implications on data protection,” in this time “maybe because of the expenses and time involved, or because they realised that the police are repeating their requests, the appellants… are playing the defendants of data protection but only for their economic and financial expediency”.
The appeals tribunal also referred to the companies’ extra expenses to provide the information.
“It has transpired that this location data is available but could be costly, both financially and in manpower, for Go Mobile and Vodafone to extrapolate,” the tribunal said, adding however that “it is the legal and civic duty of these companies to give this information by the police authorities.”
No carte blanche
On 9 May, the Police Commissioner had requested authorisation from the Data Protection Commissioner to have access to information held by Go Mobile and Vodafone. In response, the mobile phone companies had asked the Data Protection Commissioner to check the legality of the request given that the processing of personal information particular risks of improper interference with the rights and freedoms of data subjects. The Data Protection Commissioner then ruled in June that the police were entitled to collect the data required, prompting an appeal from both companies to the Data Protection Appeals Tribunal.
In its ruling, the latter tribunal remarked that during the course of their investigations, “the police required location data from Go Mobile and Vodafone, particularly in connection with the arson attacks that took place on the properties of Mr Saviour Balzan and Mrs Daphne Caruana Galizia”. The police had requested similar location data previously to help them in investigations in the case of the murder of Gozitan lawyer Michael Grech.
“It has transpired that the police authorities have not requested location data indiscriminately from Vodafone and Go Mobile but location data strictly relating to specific timeframes and geographic areas,” the tribunal observed, and in the case of the MaltaToday editor it resulted that both Go Mobile and Vodafone had already passed the information required after the arson attack on his residence.
The tribunal noted that the information requested by the police, although available to the service providers, had to be further processed by Go Mobile and Vodafone and was therefore not readily available.
The companies insisted that the data could relate to other subscribers who were not involved in any way with the crimes and also because according to the topography of the islands, a person’s mobile phone could be in one particular geographical area but caught by a base station located in another area.
The tribunal quoted data protection regulations empowering the police to have access to a personal data filing system such as the telephone companies’ in the course of “exercising their duties for the prevention, suppression, investigation, detection and prosecution of criminal offences”.
Also, the law provides for the provision of information “as a necessary measure in the interest of national security, defence, public security, the prevention, investigation, detection and prosecution of criminal or administrative offences or of breaches of ethics for regulated professions, an important economic or financial interest including monetary, budgetary and taxation matters”.
Moreover, the laws state that any person who is considered by the police to be in possession of any information or document relevant to any investigation to comply with a police request to give the required information, the tribunal said.
And citing Article 355Q of Chapter 9 of the laws, the tribunal said the police were empowered, “in addition to the power of seizing a computer machine, require any information which is contained in a computer to be delivered in a form in which it can be taken away and in which is visible and legible”.
Making it “amply clear” that the police have “no carte blanche” to ask Vodafone and Go Mobile information regarding data subjects in general, the tribunal said “the seriousness of the crimes is a major factor that is to be considered”.
“The privacy, liberty and freedom of the individual are to be protected and not violated so long as national security, defence, public security and the heinousness of crimes justifies this intrusion taking note of the principle of proportionality and relevance. It must be stated that the crimes investigated by the police authorities concerning the arson attacks fall within the ambit of this criteria and the Commissioner was correct in his judgement”.
The tribunal added that in the circumstances, the Data Protection Commissioner struck a balance between privacy rights and the administration of justice.
“It is only just and equitable that Go Mobile and Vodafone give the information requested by the police authorities … any delay will only be an instrument of advantage in the hands of these perpetrators which in a democratic society are to be suppressed as such arson attacks can destabilise our community”.
However, the information to be processed by the police within the limitations specified by the data protection commissioner, specifically that the data is to be processed only for the specific arsons investigations, that the information will not be used or processed for any other purposes, and that the data has to be erased immediately as soon as it is found to have no relevance to the investigations.
kschembri@mediatoday.com.mt
|
