Cyber Crime and Cyber Terrorism

ARRAY OF APPROVED ESURVEILLANCE LEGISLATION
With regard to the first category and especially when the request is made by 
governmental agencies, the issue of the possible violation of fundamental rights 
becomes more delicate. The Echelon Interception System (
European Parliament, 
2001
) and the Total Information Awareness (TIA) Program (
European Parliament, 
2001; European Parliament 2013a; European Parliament 2013b; DARPA. Total 
Information Awareness Program (TIA), 2002; National Research Council, 2008; 
Congressional Research Service. CRS Report for Congress, 2008
) are concrete ex-
amples which are not isolated incidents, but undoubtedly the NSA case (
European 
Parliament, 2013c; Auerbach et al., 2013; European Parliament, 2013a; European 
Parliament, 2013b
)
8
has clearly shown how could be invasive the surveillance in 
the era of global data flows and Big Data. To better understand the case, it’s quite 
8 
See fn. 6.

---

180
CHAPTER 14
Social media and Big Data
important to have an overview of the considerable amount of electronic surveillance 
legislation which, particularly in the wake of 9/11, has been approved in the United 
States and, to a certain extent, in a number of European countries.
The most important legislation is the Foreign Intelligence Surveillance Act (FISA) 
of 1978
9
which lays down the procedures for collecting foreign intelligence informa-
tion through the electronic surveillance of communications for homeland security pur-
poses. The section 702 of FISA Act amended in 2008 (FAA) extended its scope beyond 
interception of communications to include any data in public cloud computing as well. 
Furthermore, this section clearly indicates that two different regimes of data process-
ing and protection exist for U.S. citizens and residents (USPERs) on the one hand, 
and non-U.S. citizens and residents (non-USPERs) on the other. More specifically the 
Fourth Amendment is applicable only for U.S. citizens as there is an absence of any 
cognizable privacy rights for “non-U.S. persons” under FISA (
Bowden, 2013
).
Thanks to FISA Act and the amendment of 2008, U.S. authorities have the 
possibility to access and process personal data of E.U. citizens on a large scale 
via, among others, the National Security Agency’s (NSA) warrantless wiretapping 
of cable-bound internet traffic (UPSTREAM) and direct access to the personal 
data stored in the servers of U.S.-based private companies such as Microsoft, 
Yahoo, Google, Apple, Facebook or Skype (PRISM), through cross-database 
search programs such as X-KEYSCORE. U.S. authorities have also the power 
to compel disclosure of cryptographic keys, including the SSL keys used to se-
cure data-in-transit by major search engines, social networks, webmail portals, 
and Cloud services in general (BULLRUN Program) (
Corradino, 1989; Bowden, 
2013
). Recently the United States President’s Review Group on Intelligence and 
Communications Technologies released a report entitled “Liberty and Security 
in a Changing World.” The comprehensive report sets forth 46 recommendations 
designed to protect national security while respecting our longstanding commit-
ment to privacy and civil liberties with a specific reference to on non-U.S. citizen 
(Clarke et al., 2014).
Even if the FISA Act is the mostly applied and known legislative tool to con-
duct intelligence activities, there are other relevant pieces of legislation on electronic 
surveillance. One need only to consider the Communications Assistance For Law 
Enforcement Act (CALEA) of 1994,
10
 which authorizes the law enforcement and 
intelligence agencies to conduct electronic surveillance by requiring that telecommu-
nications carriers and manufacturers of telecommunications equipment modify and 
design their equipment, facilities, and services to ensure that they have built-in sur-
veillance. Furthermore, following the Patriot Act of 2001, a plethora of bill has been 
proposed. The most recent bills (not yet in force) are the Cyber Intelligence Sharing 
and Protection Act (CISPA) of 2013 (
Jaycox and Opsahl, 2013
), which would allow 
Internet traffic information to be shared between the U.S. government and certain 
9 
Foreign Intelligence Surveillance Act (50 U.S.C. § 1801-1885C).
10 
See Communications Assistance for Law Enforcement Act (18 USC § 2522).

---

181
technology and manufacturing companies and the Protecting Children From Internet 
Pornographers Act of 2011,
11
which extends data retention duties to U.S. Internet 
Service Providers.
Truthfully, the surveillance programs are not only in the United Sattes. In 
Europe, the Communications Capabilities Development Program has prompted a 
huge amount of controversy, given its intention to create a ubiquitous mass surveil-
lance scheme for the United Kingdom (
Barret, 2014
) in relation to phone calls, text 
messages and emails and extending to logging communications on social media. 
More recently, on June 2013 the so-called program TEMPORA showed that UK 
intelligence agency Government Communications Headquarters (GCHQ) has coop-
erated with the NSA in surveillance and spying activities (
Brown, 2013
).
12
 These 
revelations were followed in September 2013 by reports focusing on the activities 
of Sweden’s National Defense Radio Establishment (FRA). Similar projects for the 
large-scale interception of telecommunications data has been conducted by both 
France’s General Directorate for External Security (DGSE) and Germany’s Federal 
Intelligence Service (BDE) (
Bigo et al., 2013
).
Even if it seems that E.U. and U.S. surveillance programs are similar, there is one 
important difference: In the E.U., under Data Protection law, individuals have always 
control of their own personal data while in U.S., the individual have a more limited 
control once the user has subscribed to the terms and condition of a service.
13