Countering economic cyber espionage and the right to privacy

Abstract

This dissertation examines the use of investigatory cyber powers by intelligence and security services against state-sponsored economic cyber espionage. While often viewed as a threat to the private sector, economic cyber espionage also has significant consequences for national economies and the geopolitical position of states. Although the relationship between economic cyber espionage and national security may be subject to interpretive uncertainty, many states classify it as a national security concern. Given their mandate to safeguard national security, intelligence and security services are increasingly involved in addressing the threat posed by state-sponsored economic cyber espionage. However, the extent to which these services engage in countering economic cyber espionage, and the framework of safeguards applicable to their actions, remains under-explored. This dissertation addresses this gap, which is especially relevant given the nature of the investigatory cyber powers that intelligence and security services have at their disposal, which often involve the collection and processing of bulk data. One of the most controversial investigatory powers is the interception of data carried over fibre optic cables. In addition, intelligence services frequently employ hacking and obtain bulk datasets through alternative methods. While such capabilities are considered essential for identifying national security threats, especially in the cyber domain, they also entail significant interference with the right to privacy and data protection. This gives rise to the question of which minimum requirements for privacy and data protection apply when these investigatory powers are used by intelligence and security services against state-sponsored economic cyber espionage. This dissertation addresses that question by identifying a set of minimum requirements for privacy and data protection in this specific context. It proposes a framework against which national regimes can be assessed. The analysis proceeds in five stages: first, it examines relevant concepts and developments in the intelligence landscape, particularly on the use of investigatory powers against economic cyber espionage; second, it identifies minimum requirements for privacy and data protection; third, it adapts those minimum requirements to the specific landscape and investigatory powers; fourth, it applies the identified minimum requirements to the framework on the use of investigatory cyber powers by intelligence and security services in the Netherlands; and finally, it proposes several recommendations.