Publication report 74 regarding automated OSINT by the AIVD and MIVD
Automated OSINT involves the automated collection of data from information sources that are accessible to everyone with the aid of specialist software or web applications ('tools'). The tools include software equipped with functions for search and network analysis which can query a wide variety of sources in a user-friendly manner. In this report, the CTIVD investigated automated OSINT by the General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD). The report was published in Dutch on 8 February 2022. The Summary of the report is available in English.
OSINT is no longer just 'checking' telephone directories or searching for data on the internet using a search engine. In a single search, up to hundreds of sources can be consulted simultaneously, including location data from users’ mobile devices and leaked data from users of social media services. The results can then be visualised by the tools. Vendors for tools of automated OSINT can aggregate these datasets as a single searchable source (a 'composite dataset'), which may contain billions of records.
The current practice of automated OSINT entails a more serious invasion of privacy than was envisaged when the Intelligence and Security Services Act 2017 (ISS Act 2017) was enacted. The CTIVD therefore recommends that the legislator creates a more foreseeable legal basis with sufficient safeguards governing the use of automated OSINT for both the tools themselves and the sources that can be accessed using these tools.
Prior to actual deployment, the operation and the underlying sources of tools must be thoroughly investigated in the context of the duty of care for lawful processing. The investigation has shown that this was not done adequately. The CTIVD recommends that both services should take mitigating measures to comply with the general provisions of the ISS Act 2017 on data processing.
Report no. 74 has two appendices: the assessment framework (Appendix I) and the glossary (Appendix II) (in Dutch). The report has a classified annex.
On 8 February 2022, the Ministers of the Interior and Kingdom Relations and of Defence sent CTIVD report no. 74 to the House of Representatives, together with a joint submission letter (in Dutch).
