Feeds

'Pull European data from the US'

Europe's solution to the SWIFT problem

Internet Security Threat Report 2014

The European Parliament has recommended that the only logical way to stop US anti-terrorist investigators from illegally snooping on European financial transactions is to get the firm handling them to remove its data from US shores.

Investigators at the US Treasury have been poring over private European finances since a little after 9/11 by placing subpoenas on the Society for Worldwide Interbank Financial Telecommunication (Swift), which has an effective monopoly on the exchange of the messages that facilitate Europeans' international transactions.

But since the secret programme was exposed by the New York Times last June, European privacy watchdogs have been impotent to stop it, despite calling it illegal. They can't order banks to stop using Swift because that would stop international business dead. Neither can they stop the US from snooping on European data.

The only solution the European Parliament could see in a resolution it adopted today, was for Swift to stop storing data in the US.

"The natural consequence would be for SWIFT to be obliged to stop its current practice of mirroring all data concerning EU citizens and enterprises in its US site or to move its alternative database site outside US jurisdiction," the resolution said.

They implied that the same precaution might apply also for telecoms and other types of financial firms, like insurers, which were exempted from the Safe Harbour Agreement that protected data they held on US soil.

Swift got into trouble with EU authorities for giving US authorities access to data it handled on behalf of central and private banks not only in Europe, but among 8,000 institutions around the world. Its messages contained information about what was being paid by who, to whom.

Its system is so crucial to the operation of worldwide finance that the European Central Bank, which has been officially reprimanded for keeping schtum about the transfers, said last month that "no feasible alternatives are available".

Swift keeps a data centre in the US, where it is trying to build a business, that acts as a mirror for its main European data centre, and where all its messages are stored. US law obliged Swift to hand its data over to investigators because it was stored on US soil - even that data, according to the resolution, that "did not concern US citizens" and was not "generated on US territory".

The firm was caught in a Catch-22 - unable to resist US demands to see its data and unable to do so without breaking European data protection laws.

Now the European authorities are caught in a Catch-22 of their own. They will have to rely on Swift to help them out. It's just as well, then, that the Belgian authorities, after finding Swift at fault last year, decided not to prosecute.

Europe might not get anywhere fast by pursuing a political solution. Though it has agreed that the US investigation has offended European data protection, human and fundamental rights, it cannot get oversight of US Treasury's subpoenas on Swift until it forms an overarching, transatlantic privacy and data sharing agreement.

The challenges it faces in forming such an agreement were also outlined in the resolution. The European council has been dragging its feet over the matter, while the financial institutions, led by the ECB have dug their heels right in. The ECB said in a response to Parliament last month that its obligation to keep its economic business secret trumped any responsibility it had to fess up when the institutions in its charge broke these other laws.

This doesn't appear to have dampened the Parliament's resolve to get financiers to consider principles other than righteous economics. It has instructed the European Commission to find out if the international payment system might be hijacked for the purposes of "economic and business" espionage.

And it expressed official concern for all those "US branches of European banks, insurance companies, social security institutions and providers of telecoms services" who were as vulnerable to US subpoenas on their data as Swift was. ®

Remote control for virtualized desktops

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
'Internet Freedom Panel' to keep web overlord ICANN out of Russian hands – new proposal
Come back with our internet! cries Republican drawing up bill
What a Mesa: Apple vows to re-use titsup GT sapphire glass plant
Commits to American manufacturing ... of secret tech
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?