In a new report, the CTIVD — the oversight body for the Dutch intelligence services — once again examined how the AIVD and MIVD process bulk datasets. The verdict? The services still don't have their processes in order, and they are not complying with the law.

A big shout out to our volunteers for translating our articles into English! 

The CTIVD's report shows that too many people have access to too much data, that data is kept for too long, and that data is being used for purposes it's not supposed to be used for. The oversight body issued no fewer than thirteen recommendations.

Our take on the report

Three things stand out. First: this is not the first time the services have failed to comply with the law. Back in 2020, it came to light that the AIVD and MIVD had been retaining data on millions of citizens for far too long. After a complaint from Bits of Freedom, they were forced to destroy it. Apparently they haven't learned from that.

The second thing that stands out is that the intelligence services appear to be training their own AI — with our data. They even seem to be buying data that originates from data breaches. Shouldn't they be the ones protecting us against exactly that? Of course, they're also using data they collect themselves on a massive scale. And unlike with most commercial providers, as a citizen you can't opt out. What's more, the services aren't even allowed to do this.

Finally: this report shows why strong, binding oversight is essential. Only then can citizens and politicians see what the intelligence services are actually doing in practice, form an opinion about it, and hold them politically accountable.

Even more power

What this report also illustrates is that the services keep asking for more power, while repeatedly demonstrating that they can't handle the power we've already given them. They're failing to get their data management in order and refuse to be held to the law. That's all the more troubling coming from a government body that by design operates in secret. Oversight of these services must therefore absolutely not be weakened.

It's important to pay close attention to this in the upcoming revision of the law. The Wiv 2017 — the act governing the work of the intelligence services — is being revised and will likely be released for public consultation in August. Questions that will be front and center: should oversight be weakened, as the services want, or should it be strengthened instead? Is training AI a sufficient reason to process the private communications of millions of people? And how do you actually deal with services that break the law time and time again?

Citizens and organizations will have roughly six weeks to respond to the proposal. Bits of Freedom is calling on everyone in the Netherlands to do so.