Switzerland’s new surveillance law

The debate around surveillance around the world is a developing story. Multiple states are considering, working on or applying new investigative powers (e.g. United Kingdom’s Investigatory Powers Bill or France’s Patriot Act à la française) strengthening surveillance capabilities; this trend is visible around the world. Investigatory powers are progressively reliant on electronic monitoring and surveillance techniques. Those methods are increasingly technically advanced and widely used; surveillance can be applied towards individuals (targeted) and en masse (towards a group of people, e.g. the whole nation, perhaps beyond). Governments are also trying to fiddle with laws endangering encryption. Questions about oversight are frequently being raised around the world.

It’s always interesting to observe exceptions (outliers) to a trend. Indeed, one country recently has set an interesting precedent. Back in 2015, Swiss government tried to pass a new law-enforcement legislation. Fast forward to Sunday, 25th September and the Swiss adopted the “LRens” legislation in a referendum. Swiss intelligence agency SRC will obtain new hacking and surveillance capabilities. So far, it looks like a typical example in a wider trend; new surveillance and radioelectronic (SIGING) capabilities, hacking foreign electronic infrastructures (“cyberoperations”), etc...

But it’s not typical; it's unprecedented and important.

Swiss-made oversight and notification

Switzerland has set a number of interesting precedents.

The oversight will be tight. Swiss SRC will need to request permission from a number of bodies. But the more interesting part is the legal obligation to inform the subject of surveillance after an operation is finished, as reported by quality Swiss newspaper Tribune the Geneve:

A la fin de toute opération, la personne surveillée devra en être informée, sauf si des intérêts publics prépondérants s'y opposent ou si la protection de tiers est compromise.

Which has the following meaning. At end of an operation, the person under surveillance will be informed within a month period (except for some exceptional cases against the public’s interest). It’s written down on a legal paper.

It’s also unprecedented, as in most (if not all) of law-enforcement legislations around the world, such a strong legal obligation is difficult to find. Let’s look on the actual law bill. Article 33 (“Obligation d’informer les personnes surveillées” - “obligations of informing persons under surveillance”; link to the full bill) states in verbatim:

A la fin d’une opération de surveillance impliquant des mesures de recherche
soumises à autorisation, le SRC informe la personne surveillée dans un délai d’un
mois des motifs, du type et de la durée de la surveillance à laquelle elle a été sou-
mise.

Which has the following meaning: at and of a surveillance operation, SRC will be legally obliged to inform the subject, within one month about the justification, type and length of the surveillance.

Hacking capabilities

There are things in the bill that are equally interesting, albeit not setting a world-precedent. According to the new bill, SRC agency will be able to conduct espionage operations - hack and infiltrate information systems based in foreign countries.

SRC will also be conducting radio-electronic (SIGINT) surveillance. Specifically, SRC will have the power to monitor communications passing Switzerland. Even more in verbatim: SRC will have the legal powers to tap into networks that pass Switzerland (Article 39.1 of the bill). Although some might regard this particular item as going contrary to a world-trend of treating Switzerland as a data privacy save haven, but the oversight mandated by the LRens bill is strong.

Summary

Switzerland has adopted a legislation strengthening law enforcement capabilities, as many countries do. But an introduction of a strong oversight and a notification mechanism after surveillance is something unprecedented and substantial. It is very different than the attitude usually encountered in Europe or USA. This example deserves to be widely debated.