In late June 2020, Robert Williams, an African-American resident of Detroit, was arrested at the entrance of his home in front of his two young daughters. No one could tell him why. At the police station, he was informed that he was considered a suspect in the 2018 robbery of a store, as his face was identified by in-store security surveillance footage. The identification was based on an old driver’s licence photo. After thirty hours in custody, Robert Williams was eventually released. The cynical confession of the Detroit police officers was disarming: “the computer probably made a mistake.” 

A similar incident occurred in June 2019 to Michael Oliver, also an African-American Detroit resident, who was arrested after the alleged identification of his face on a security-camera video. He was taken to trial, where he was eventually acquitted three months after his arrest. Similarly, in a test study of Amazon’s Rekognition software, the program incorrectly identified 28 members of Congress (!) as people who had previously been arrested for a crime. The misidentifications overwhelmingly involved blacks and Latinos. But do not assume that this only happens in the US. 

As discussed in the previous two parts of MIIR’s investigation on “The Digital Walls of Fortress Europe”, the EU, as part of a new architecture of border surveillance and mobility control, has in recent years introduced a number of systems to record and monitor citizens moving around the European space.

The EU is using different funding mechanisms for research and development, with an increasing emphasis on artificial intelligence (AI) technologies, which can also use biometric data. Between 2007 and 2013 (but with projects running until 2020) the most relevant of these was the Seventh Framework Programme (FP7), followed by Horizon 2020. These two programmes have funded EU security projects worth more than €1.3 billion. For the current period 2021-2027, Horizon Europe has a total budget of €95.5 billion, with a particular focus on ‘security’ issues. Technologies such as automated decision-making, biometrics, thermal cameras and drones are increasingly controlling migration and affecting millions of people on the move. Border management has become a profitable multi-billion-euro business in the EU and other parts of the world. According to an analysis by TNI (Border War Series), the annual growth of the border-security market is expected to be between 7.2 % and 8.6 %, reaching a total of USD 65-68 billion by 2025. 

The largest expansion is in the global Biometric Data and Artificial Intelligence (AI) markets. The biometrics market itself is projected to double its turnover from $33 billion in 2019 to $65.3 billion by 2024. A significant part of the funding is directed towards enhancing the capabilities of EU-LISA (European Agency for the Operational Management of Large Scale IT Systems in the Area of Freedom, Security and Justice) which is expected to play a key role in managing the interoperability of databases for mobility and security control. The activities of this supercomputer are funded by:

• a grant from the general budget of the EU. 
• a contribution from the member states related to the operation of the Schengen area and Eurodac related measures.
• direct financial contributions from member states. 

Chris Jones, Executive Director of the non-profit organisation Statewatch, has been following the money trail starting in Brussels for several years. He explains that “EU-research projects are usually run by consortia of private companies, public bodies and universities. Private companies receive the largest sums, more than public bodies.” A recent Statewatch study (Funds for Fortress Europe: spending by Frontex and EU-LISA, January 2022) highlights that around €1.5 billion was directed to private contractors for the development and strengthening of EU-LISA in the period 2014-2020, with the largest increase occurring after 2017 and the peak of the refugee crisis. 

The surveillance oligopoly

One of the most important contracts signed in 2020, worth €300 million, was between French companies Idemia and Sopra Steria for the implementation of a new Biometric Matching System (BMS). These companies often win new contracts as they have agreements for the maintenance of the EES, EURODAC, SIS II and VIS systems. Other companies that have been awarded high-value contracts for EU-LISA-related work are Atos, IBM, and Leonardo – for €140 million – and the consortium Atos, Accenture and Morpho (later Idemia) which in 2016 signed a contract worth €194 million.

Data collected by Statewatch also shows cooperation – usually through joint ventures – in the expansion of the EU-LISA system with companies of Greek interests, such as Unisystems SA (owned by the Quest Group of former President of the Association of Greek Industrialists Th. Fessa), which signed a €45 million contract in 2019. Similarly, European Dynamics SA (owned by Konstantinos Velentzas) participated in a €187 million contract awarded in 2020, and Luxembourg-based Intrasoft International SA (previously owned by Kokkalis interests) is participating with five other companies in a €187 million project in 2020. 

The new frontier of AI and the pressures on the EU

In April 2021, the European Commission published its long-awaited draft regulation on artificial intelligence (AI ACT). The consultation process is expected to take some time. This important piece of legislation exceeds 200 pages and which will be – among other things – a refinement of the data protection legislation (Directive 680/2016). There is expected to be considerable pressure exerted by companies and operators in the sector until the bill is submitted in its final form to the European Parliament.

MIIR has investigated the records of official meetings on AI and digital policy issues between European Commission President Ursula von der Leyen, Commissioner Margrethe Vestager (“A Europe Fit for the Digital Age”), Commissioner Thierry Breton (Internal Market) and their staffs between December 2019 and March 2022. It emerges that at least 14 agencies, private sector giants and consortia of companies related to the security and defence sector met with key representatives of the European Commission 71 times in 28 months to discuss issues related to digital policy and AI. Most meetings with the Commissioners were held by DIGITALEUROPE, an organisation representing 78 corporate members, including major defence and security companies such as Accenture, Airbus and Atos. Other consortia were also identified to be lobbying heavily, such as the European Round Table for Industries (ERT) which represents a number of defence and security companies such as Leonardo, Rolls-Royce and Airbus.

High-risk systems

The proposal for the European regulation (COM/2021/206 final) adopted in April 2021, gives a good overview of the AI systems and applications that are expected to be regulated, and the risks of their unregulated operation at Europe’s entry points. As stated: “[…] it is appropriate to classify as high-risk AI systems intended to be used by the competent public authorities responsible for tasks in the areas of immigration management, asylum and border control as polygraphs and similar tools or for detecting the emotional state of an individual; for assessing certain risks presented by natural persons entering the territory of a member state or applying for a visa; for assessing certain risks presented by natural persons entering the territory of a member state or applying for a visa; for assessing the risk of a person’s personal data […]”

The critical parameter

The scope of the field where ‘high-risk’ AI systems can be applied seems wide. Despite hopes that a new directive will regulate how they operate, there is one parameter that may remove this possibility. As revealed in an internal presentation by the European Commission’s internal review that took place in May and was brought to light by Statewatch, the new regulation, if passed, will come into force 24 months after it is signed and will not apply to all systems, as it is not expected to be retroactive to those on the market before the effective date.

Robo-dogs in action: Algorithms and nightmarish research projects

“There is a great effort by EU institutions and member states to increase the number of deportations. The EU has poured money and resources and these databases to essentially say ‘we want to help remove these people from European soil’,” Statewatch’s Chris Jones points out. Indeed, automation and the use of industry-pushed algorithmic tools are already playing an important role at Europe’s entry points, raising many questions about safeguarding the rights of refugees and migrants. It is not only the profiling that worries those who criticise these EU projects, but also the quality of the data on which this process is based. “It looks like a ‘black box’, where we don’t know exactly what’s inside,” says refugee law specialist and anthropologist Petra Molnar, who focuses on the risk of automation without a human factor in decision-making when it determines human lives.

Some of the major pilot systems funded in the past few years include the following:

• iBorderCtrl – “smart” lie detectors 

Combines facial matching and document authentication tools with AI technologies. It is a “lie detector”, tested in Hungary, Greece and Latvia, and involved the use of a “virtual border guard”, personalised for the gender, nationality and language of the traveller – a guard asking questions via a digital camera. The project was funded with €4.5 million from the European Union’s Horizon 2020 programme, and has been heavily criticised as dangerous and pseudo-scientific (“Sci-fi surveillance: Europe’s secretive push into biometric technology”, The Guardian, 10 December 2020; “We Tested Europe’s New Lie Detector for Travelers – and Immediately Triggered a False Positive”, The Intercept, 26 July 2019).

It was piloted under simulated conditions in early July 2019 at the premises of TRAINOSE in a specially designed area of the Security Studies Centre in Athens. Before departure the traveller had to upload a photo of an ID or passport to a special application. They then answered questions posed by a virtual border guard. Special software recorded their words and facial movements, which might have escaped the attention of an ordinary eye, and in the end the software calculated – supposedly – the traveller’s degree of sincerity.

On 2 February 2021, the European Court of Justice ruled on a lawsuit brought by MEP and activist Patrick Breyer (Pirate Party) against the privacy of this research project, which he called pseudo-scientific and Orwellian.

• Roborder (an autonomous swarm of heterogeneous robots for border surveillance) 

• Foldout 

The €8.1 million Foldout research project does not hide its aims: “in recent years irregular migration has increased dramatically and is no longer manageable with existing systems”. The main idea of the project, piloted in Bulgaria and being rolled out in Finland, Greece and French Guinea, is to place motion sensors on land sections of the border where terrain or vegetation makes it difficult to detect an irregular crossing. With any suspicious movement, human or vehicle, there will be the possibility of sending a drone to that point or activating ground cameras for additional monitoring. The consortium developing it is coordinated by the Austrian Institute of Technology (which has received €25 million from 37 European projects).

Among the organisations lobbying for these projects at the European level, we met EARTO, a consortium of research centres and project beneficiaries in various fields, including security. These included KEMEA in Greece, the Fraunhofer-Gesellschaft (140 EU-funded research projects, including Roborder) and the Austrian Institute of Technology (Foldout). 

Many of the Horizon 2020 research projects (Roborder, iBorderCtrl, Foldout, Trespass, etc.) have been described by their own authors as still “immature” for widespread use. However, the overall shift in the European Union’s approach to the use of AI for mobility control and crime prevention can be seen in the ever-increasing funding of the European Security Fund. One such project is the supply of thousands of mobile devices by the Greek police that will allow citizens to be identified using facial recognition and fingerprinting software. The total cost of the project, undertaken by Intracom Telecom, exceeds €4 million and 75% comes from the European Security Fund. 

The Samos “experiment”

“Borders and immigration are the perfect laboratory for experiments. Opaque, high-risk conditions with low levels of accountability. Borders are becoming the perfect testing ground for new technologies that can later be used more extensively on different communities and populations. This is exactly what you see in Greece, right?”, asks lawyer Petra Molnar. The answer is in the affirmative, both for the north and the south of the country.

On the island of Samos on Greece’s south-eastern border with Turkey, at the new migrant camp which the Greek government is almost advertising, two special pilot systems called HYPERION and CENTAUR are being put into operation.

• HYPERION is an asylum management system for all the needs of the Reception and Identification Service. It processes biometric and biographical data of asylum seekers, as well as of the members of NGOs visiting the relevant structures and of the workers in these structures. It is planned to be the main tool for the operation of the Closed Reception Centres (CRCs) as it will be responsible for access control, monitoring of benefits per asylum seeker using an individual card (food, clothing supplies, etc.) and movements between the CRCs, and accommodation facilities. The project includes the creation of a mobile phone application that will provide personalised information to the user, to act as their electronic mailbox regarding their asylum application process, with the ability to provide personalised information.
• CENTAUR is a digital system for the management of electronic and physical security around and within the premises, using cameras and AI behavioural analytics algorithms. It includes centralised management from the Ministry of Digital Governance and services such as: signalling perimeter breach alarms using cameras (capable of thermometry, focus and rotation) and motion analysis algorithms; signalling of illegal behaviour alarms for individuals or groups of individuals in assembly areas inside the facility; and use of unmanned aircraft systems to assess incidents inside the facility without human intervention. 

“CENTAUR uses cameras that have a great ability to focus on specific individuals, cameras that can also take someone’s temperature. The most important thing is not that CENTAUR will use this image for security reasons, it is that behavioural analysis algorithms will also be used, without explaining exactly what it means,” says lawyer and member of Homo Digitalis, Kostas Kakavoulis. As he points out, “an algorithm learns to come to certain conclusions based on some data we have given it. Such an algorithm will be able to distinguish between the fact that person X may have increased aggressive behaviour, and may attack other asylum seekers or guards, or may want to escape from the accommodation facility illegally. Another use of behaviour analysis algorithms is lie analysis, which can judge whether our behaviour and our words reflect something that is true or not. This is mainly done through the analysis of biometric data, the data that we all produce through our movement in space, through our physical presence, through our physical appearance and also the way we move our hands, the way we blink, the way we walk, for example. All these may seem insignificant, but if someone can collect them over a long period of time and can correlate them with the data of many other people, they may be able to come to conclusions about us, which may surprise us, about how aggressive our behaviour can be, how much anxiety we have, how afraid we are, whether we are telling the truth or not.” In the current legislation, it is prohibited to process personal data without the possibility of human intervention. 

Lawyer Petra Molnar has recently been researching the effects of AI applications on the control of migration flows. She was in Samos at the opening of the new closed reception centre. “Multiple layers of barbed wire, cameras everywhere, fingerprint stations at the rotating gate, entry-exit points. Refugees see it as a prison complex. I will never forget that. On the eve of the opening I was at the old camp in Vathi, Samos. We talked to a young mother from Afghanistan. She was pushing her young daughter in a pram and hurriedly typed a message on her phone that said: ‘If we go there, we’ll go crazy’. And every time I look at the camps with these systems, I realise that it embodies that fear that people have when they’re going to be isolated, and surveillance technologies are used to further control their movements.” 

Médecins Sans Frontières described the new structure in Samos as a “dystopian nightmare”. They were not alone. “The CENTAUR system is framed by the use of highly intrusive technologies to protect privacy, personal data as well as other rights such as behavioural and motion analysis algorithms, drones and closed circuit surveillance cameras. There is a serious possibility that the installation of the YPERION and CENTAUR systems may violate the European Union legislation on the processing of personal data and the provisions of Law 4624/2019”, the NGO Homo Digitalis points out. The Hellenic Human Rights Association, HIAS Greece, Homo Digitalis and a Lecturer at Queen Mary University of London Dr Niovi Vavoula filed a request before the Greek Data Protection Authority (DPA) on 18 February 2022 for the exercise of investigative powers and the issuance of an Opinion on the supply and installation of the systems. On Wednesday 2 March 2022, the Authority commenced an investigation of the Department of Immigration and Asylum in relation to the two systems in question. 

The automation fetish

“The problem is that authorities, and politicians, are beginning to perceive advanced data analytics as factors in some kind of objective and unbiased knowledge about security issues, because they have this aura of mathematical precision. But artificial intelligence and machine learning can actually be very accurate in reproducing and magnifying the biases of the past. We should remember that poor quality data will only lead to bad automated, biased decisions,” says researcher George Glouftsios.

We wonder why we use robot dogs, sound cannons and lie detectors at our borders but do not use AI to weed out, for example, racist border guards. 

Flash forward. In 2054 the Washington DC police department has created a special pre-crime police team that arrests crime suspects before they even commit the crime. The predictions are made by three mutant human beings, who are in a state of permanent hypnosis and are able to see the future, including the potential criminal, before he or she even goes through with the act. It is a stretch – for the moment – to claim that we are approaching the fantasy of Philip Dick in Minority Report.

But what is not far off is the existence of various systems of behavioural analysis including lie detectors, facial and emotional recognition software, with automated decision-making on the horizon. All this – in a context of militarisation of the EU’s external borders, in a context of treating people on the move as a potential threat – risks creating a dangerous human laboratory, a high-risk experiment around fundamental human rights. 

Check out: Part 1 – The ecosystem of European biometric monitoring and surveillance data

Check out: Part 2 – Trapped in a digital surveillance system

*This article has been produced within the Panelfit project, supported by the Horizon 2020 program of the European Commission (grant agreement n. 788039). The Commission did not take part in the production of the article and is not responsible for its content. The article is part of the independent journalistic production of EDJNet

At the Greek Consulate in Istanbul, one morning in 2016, Erkan, a Turkish citizen of Kurdish origin, crosses the threshold of the building to address the Greek authorities. He was seeking a visa to enter Greece in order to flee Turkey at a time when the Erdogan regime was stepping up persecution, particularly against the leadership and members of the opposition HDP party and its Kurdish supporters. The Greek consular authority, however, rejected the visa request and Erkan was forced to remain in Turkey.

Οrestiada Evros, 4 years later. Erkan was arrested at the Greek-Turkish border as he attempted to enter Greek territory and was taken to court. The court sentenced him to 4 years in prison without suspension and a 10,000 euro fine on charges of re-entering the country. But Erkan had not re-entered Greece.

What had happened? In front of Greek judges, Erkan sought asylum from Greece for persecution by the Erdogan regime, but was told that his name was on the National List of Unwanted Aliens (EKANA) and the Schengen Information System (SIS II, the largest information exchange system between Schengen countries), with a note that he had been banned from entering the country for 7 years. Because of his inclusion on these lists, he was taken first to Komotini prison and then to Corfu prison.

“We were trying to find out what had really happened” recounts Erkan’s lawyer and Human Rights 360 attorney, Eugenia Kouniaki. “My client had never entered Greece before and was suddenly convicted of re-entering the country. Initially, I contacted the police authorities, the Director of the Asylum Service in Athens, where he replied that my client had been included in the EKANA and SIS II because his visa had been rejected by the Consulate in Istanbul.”

 The truth was quite simply to be found in the operation of the Single European Visa Information System (VISA-VIS) and SIS II. The Greek consulate that processed Erkan’s application entered the visa refusal in the VIS system and in SIS II at the same time. From then on, this record was enough to get him on his way to prison, even if he sought international protection.

“Even when I asked for his removal from the undesirable list and SIS II, as Erkan was an asylum seeker, the Greek police refused,” Kouniaki describes. “Apart from the fact that my client did not know that he was on the list, when we tried to find out why his visa was refused in 2016, we received the vague answer ‘for falsifying some documents’. When we attempted to find out what documents were claimed to have been falsified, we could not check what they were. Fortunately, in the appeal that we filed for a delay in implementing the sentence, the judges accepted our arguments, and after a year he was released from prison.”

However, after all this unfair treatment and imprisonment, he preferred to leave the country “because he believed that he would never find justice,” Kouniaki concludes.

Burning fingers to avoid identification in EURODAC

Erkan’s story may sound outrageous, but unfortunately it is not the only one linked to the consequences of surveillance technologies and biometric data systems for migrants. In the report “Technological Testing Grounds: migration management experiments and reflections from the ground up” (EDRi, Refugee Law Lab, November 2020), author Petra Molnar, a lawyer and member of EDRi (European Digital Rights), has collected a multitude of interviews with asylum seekers in Brussels who came into contact with mobility control systems during their journey to safety in Europe.

Caleb, a married man in his 30s, describes his experience of the asylum process by saying he felt “like a piece of meat with no life, just fingerprints and iris scans”. Another migrant, Esche, describes her encounter with drones in the Mediterranean and the English Channel with a devastating quote the moment she saw them in the sky: “now we have flying computers instead of more asylum”.

The most unpleasant story is told by Negassi, a 20-year-old from Ethiopia: ‘I am tired and I want to go to England’ he says after being stranded in Brussels for nearly two years, undocumented, and earlier the same in Nuremberg for 5 years. But this is not his first time in Belgium, as he was deported to Germany before when he was arrested in a park in Brussels, where he was sleeping rough. When his biometric data was taken by the Belgian police, his fingerprints showed a hit on the EURODAC system, which stores and identifies the fingerprints of asylum seekers, identifying him as a first-time asylum seeker in Germany. So they sent him back because of Dublin II, which stipulates that the first host country has to process the claim.

Negassi acknowledges that the process of collecting biometric data is invasive to the body, but asks: “How can I refuse when the police handcuff me, take me to the station and force me to give my fingerprints?” he tells Molnar. He has friends who have gone so far as to burn their fingers to alter their fingerprints and avoid identification. “However, that doesn’t solve the problem” for Negassi, as no identification usually means a longer detention period.

“There is a very important aspect that is not discussed enough in the public debate,” Petra Molnar tells us, “and it concerns the fact that these surveillance technologies cause trauma to people who are not even familiar with the technology. The migrants I spoke to all had a strong belief within them that they were experiencing racist and discriminatory treatment through their contact with these systems.”

This is why it is even more important, he continues, “in terms of the rampant use of these technologies, that there is accountability, oversight and governance. We need to focus on what kind of governance structures need to be developed to ensure that these technologies, which are a human-rights risk, do not cause trauma to people.”

The accountability part, however, does not seem to be enhanced by the way these systems are developed. The involvement of private companies in the security and defence industries further complicates matters. “There is a very problematic relationship of private companies and state institutions working together under the guise that states themselves cannot develop these technologies in-house”, points out Molnar. “So huge public resources are directed to big companies to develop them. But also from a legal point of view, it creates the problem of what some call ‘responsibility laundering’ when something goes wrong. In these cases, as we have seen, the state says ‘it is not our problem because we did not develop this technology’. And the private company for its part retorts that ‘the state management of the tools is to blame’.”

But public budgets for the industrial complex of migration management and border control are substantial, Molnar points out. “Of all that money in such a problematic technology that inflicts trauma, imagine if it went to education, legal services, housing. Why don’t states, instead of pouring so much money into surveillance technologies, think about how to use it for social inclusion?”

The European Border Surveillance system (Eurosur) and the money for drones

Perhaps the most interesting system for migration issues is Eurosur, which produces maps of both territorial/land and maritime borders. It is operated by Frontex and allows for the exchange of maps between states regarding border controls at sea. “The development of Eurosur was launched in 2007, but it reaches the European Parliament for the first time at the end of 2012, after hundreds of millions have been spent and its design has been completed, effectively presenting the institution with a fait accompli. Due to the lack of transparency, the research in the relevant directorates of the European Commission is largely captured by the priorities of the security-industry complex”, journalist Apostolis Fotiadis reported in his book “Border Merchants”.

When it was first developed it was promoted as a “humanitarian technology”, a system that would allow the authorities of each member state to conduct search and rescue operations. The idea was that “we use maps, we get information from satellites and also from drones, to perceive migratory flows, for example from Africa to Europe, so that we can rescue people at sea”. The problem is that Eurosur creates so-called pre-frontier pictures. These are maps that focus on the area before the border, before a ship arrives at the maritime border, for example Greece. “Mainly they do it to organise pull-back operations, because for example the Italian authorities can share data with the Libyan authorities so that the Libyan authorities can take back the migrants. They know that push-backs are not allowed, so the solution is pull-backs. That’s why Libya is funded,” explains Georgios Glouftios, a lecturer at the University of Trento, to MIIR.

For the creation of the pre-frontier maps, Frontex also cooperates with the European Union Satellite Centre (EU SatCen), which provides it with satellite imagery, aerial photographs and other related services. The Eurosur database also records incidents occurring at the EU maritime borders, although member states have not been obliged until now to upload data from incidents at border checkpoints in a systematic and organised manner (this changed with an implementing regulation in April 2021). Which means that there is no complete and methodical recording of incidents, blurring the overall picture of incidents at the external borders. A fact that is also admitted by the European Commission in the Eurosur evaluation report (September 2018).

Frontex’s second report in 2018 on the operation of Eurosur recorded over 184,000 incidents in the period from December 2013 to the beginning of 2018, with the vast majority (147,827) relating to migratory flows.

In February 2022, the French government announced that it would install additional cameras along the Channel coast to help monitor migrants hoping to cross the stretch of water to the UK. The cameras are being paid for by the British government. In December 2021, the Italian navy delivered a new shipment of containers with surveillance equipment to Libya to monitor migration in the Mediterranean (source: Altreconomia research magazine, February 2021 issue). Additional “trap cameras” for cars and people have also been placed at or near the border between Italy and Slovenia along the so-called Balkan route.

Eyes in the sky

Frontex confirms that it uses “a set of services falling under Eurosur, the information exchange framework designed to improve the management of Europe’s external borders” (source: infomigrants.net, “Digital borders: EU increases use of technology to monitor migration”, 18.2.2022). It states that most of this monitoring is carried out “by aerial surveillance by manned and unmanned aircraft, with satellite imagery devices and collection of vessel positions through positioning systems”.

According to a recent in-depth survey (“Funds for Fortress Europe: spending by Frontex and EU-LISA”, January 2022) by the non-profit organisation Statewatch, Frontex spends most of its annual budget on maritime and aerial surveillance, alongside deportations (chartered and scheduled flights for the return of migrants). According to data analysis carried out by Statewatch, between 2014-2020 Frontex together with the European agency EU-LISA (which oversees large-scale mobility-control information systems) spent a combined €1.9 billion on contracts with private IT companies and the security and defence industry. Of this money about half a billion (€434 million) was managed by Frontex with more than €100 million going to contracts with private companies related to air surveillance. This included a €50 million contract with the Airbus consortium – one of the leading trans-European companies in the aerospace and defence industry – and the Israeli company Elbit, which supplies 85% of the Israeli army’s drones.

In the same period, Frontex seems to have had a profitable relationship with three other air surveillance service providers: the Canadian CAE Aviation, the British Diamond-Executive Aviation (DEA) and the Dutch EASP Air. As a consortium they won contracts worth a total of €57 million (not counting the contracts they have signed alone for other security and control services to Frontex).

The same trend continued in 2021 with €84 million – i.e. one sixth of Frontex’s annual budget – going to air surveillance services.

In the deportation process, Frontex has worked with the Polish eTravel SA on €50 million contracts to provide travel services (booking and ticketing services) for the scheduled return flights. It has also worked with the British multinational Air Charter Service Limited and the Norwegian AS Aircontact in flight chartering for the same purpose.

London-based Privacy International in July 2021 published its findings on how an increasing number of companies are “developing satellites capable of tracking and selling their data to border agencies”. The organisation concluded that while “such surveillance can save lives, it can also facilitate pullbacks or be used to persecute asylum seekers”.

The use of all these surveillance technologies also has a deeper consequence, underscores Antonella Napolitano, network coordinator of Privacy International. “On the one hand, it contributes to the criminalization of the migrant’s person, and at the same time it turns him into a data hub, from the beginning of the journey from the country of origin to the evaluation of biometric data in the EU. The aim is to fully record his movement and track him until the next steps within the European area. Indeed, if he is found trapped because of a wrong recording or decision within these systems where his data is stored, this error follows him for the rest of his life.”

This notion is not unconnected to the risk of extending surveillance to the whole range of travel, whether for tourism or work. Moreover, Napolitano points out, “the very interoperability of the systems is a good example of how a system developed to monitor migratory movements can then be extended to everyone, as these systems are progressively extended to all travellers entering the European area, but also to EU citizens moving within the EU”. 

“Being potentially considered a ‘criminal by default’, a concept reflected in the management of surveillance technologies, cannot leave anyone indifferent,” Napolitano concludes.  

Passenger Name Record: the monitoring of intra-EU movements

The Passenger Name Record (PNR) concerns the recording of all data of passengers moving within European territory, regardless of whether they come from a third country. What does this system collect?  Name, nationality, when we travelled, where from, where to, our email, our address. Apart from that, one can find out our travelling companions, possibly some data related to our stay such as hotel reservations, whether we travelled for business or personal reasons. It can probably even find out in an extreme case our religion, as the system even records the meal we ate during our flight. This meal may contain ‘interesting’ facts about us, e.g. if we eat kosher we are Jewish, if we don’t eat pork it means we are Muslim. It may also reveal if someone has allergies.

The PNR is accessible to the police authorities of each country. “And this is where the problems start. There is a European directive on how personal data can be processed through the PNR system. This European legislation must be transposed into national law in each country. The problem is that we have some failures in the transposition of this directive in different countries, such as Greece,” says lawyer Kostas Kakavoulis, a member of Homo Digitalis, to MIIR. As he explains, “the European directive says that each member state shall establish or designate an authority which is responsible for the prevention, detection, investigation and prosecution of serious terrorist offences. So we are talking about an authority that is either established from the outset or exists and is given this competence. In Greece, the legislature has given this competence to a department within the Directorate of Information Management and Analysis of the Greek Police. So we are not talking about an authority but a directorate of the Greek police. It is absurd for the body which holds the data, the police, to ask for access to this data from a department within the police. If it is subject to hierarchical control or if there are pressures in general, it is rather doubtful that a department of the Greek police will refuse to provide other departments of the Greek police with data that they need, even if it were necessary to do so. In France this is not the case, as a special independent authority has been set up for PNR data. In Greece any police force can have uncontrolled access to PNR data anywhere, anytime. There is no record anywhere of who requested which data, when and for what purpose. And there is no classified access policy. You only need to be a member of the police force to access this data.”

In Greece, the organisation Homo Digitalis (member of EDRi), in an open letter to the parliament, underlines that “the data in question can reveal the pattern of a person’s movements, such as the time of travel, the place of departure and arrival, his/her email and address, as well as a person’s travelling companions, but possibly even related hotel reservation data, etc., thus revealing information on business or personal travel and even the person’s social circle, such as friends or companions”.

The organisation notes that in the draft law submitted in 2018 in Greece there was:

• lack of a system for recording access to PNR data
• lack of prior judicial control over the provision of PNR data to pre-trial and other authorities
• the retention period of PNR data is not limited to the strictly necessary period

Four years later, the same shortcomings remain.

The organisation stressed that PNR data of minors transferred should be described clearly and accurately, and that any data transferred should not reveal either religious beliefs or information about the passenger’s health.

In part one of MIIR’s investigation: The ecosystem of European biometric monitoring and surveillance data

In part three of MIIR’s investigation: the features of artificial intelligence and algorithmic systems in the new mobility-screening regime, and the private contractors building and marketing them in the EU.

*This article has been produced within the Panelfit project, supported by the Horizon 2020 program of the European Commission (grant agreement n. 788039). The Commission did not take part in the production of the article and is not responsible for its content. The article is part of the independent journalistic production of EDJNet