Border Security The Surveillance Superstate

In an effort to curb illegal migration and transnational crime, the European Union is spending billions of euros on external border security. But a new investigative report has found these programs violate data collection laws and serve industry interests more than those of European taxpayers.
Syrian refugees pray after arriving on a boat on the Greek island of Lesbos. A Frontex helicopter flies overhead. Photo: REUTERS/Alkis Konstantinidis

Whether it’s paying for drones to patrol the Mediterranean or databases to store personal information on millions of individuals: the European Union has spared little expense in the name of protecting its external borders.

Through 2020, the E.U. plans to put more than €6 billion ($6.26 billion) toward border security and surveillance technologies and operations, with a similar level of funding to come from member states themselves. But a new study conducted by a multinational team of nine journalists – including the authors of this report – suggests that those investments do little to make Europeans safer and more secure.

“Investigate Europe” analyzes more than 200 interviews with border police officers, investigators, legal experts, engineers, E.U. officials and politicians, over a period of two months to determine how well the bloc’s border protection program delivers on its promises.

The conclusions are sobering: Not only is Brussels shelling out money for unproven solutions, it is also offering various members of the security industry - via their inclusion on consulting bodies – broad influence in determining which security and surveillance technologies E.U. authorities should fund and mandate.

Even more worrying is the fact that the European Commission and national governments are undermining traditional safeguards on personal data, opting to store information on millions of E.U. citizens for several years - without judicial oversight.

It was the terror attacks of September 11, 2001 in the United States that kick-started the buildup of Europe’s own external border-defense apparatus. When Washington first began mobilizing for its “War on Terror,” the countries that made up Europe’s passport-free Schengen zone lacked a common security policy.

National governments eventually tasked the European Commission with developing a plan. Brussels, however, needed know-how, and looked to a team of ex-politicians and industry managers to deliver the necessary recommendations. The group’s membership was a virtual who’s-who of Europe’s defense and electronics companies, from EADS and BAE to Siemens.

Its report, published in early 2004, called for Brussels to follow Washington’s security lead – and to provide ample funding for the integration of civil and military security research. Otherwise, the group said, the U.S. would dominate the field.

Within months, the European Commission under then President José Manuel Barroso launched a €40-million research program based on the recommendations of executives whose companies stood to benefit. A second, €1.4-billion program followed in 2007, and a third worth some €1.7 billion has been underway since 2014.

Parallel to these programs, Schengen countries began paying into joint funds to cover the costs of purchasing the technologies in development. Starting out with €1.3 billion, another €1.7 billion in funding eventually followed. From 2014 through to 2020, the Internal Security Fund has been allotted a budget of some €2.8 billion to pay for surveillance improvements.

“That was a very consequential decision,” said Peter Burgess, a professor of security policy at the École Normale Supérieur in Paris. “At the time of the attacks in New York, the European strategy became one of developing an independent security industry,” he said. Since then, industry managers have been the ones to determine what constitutes security, resulting in a consistent gravitation toward surveillance technologies, despite the fact that “it’s not documented whether it even works.”

Warsaw is home to the E.U. border protection regime’s beating heart: the European Border and Coast Guard Agency, or EBCGA, known until recently as Frontex. It processes incoming information from 30 national border security agencies, ranging from reports of smugglers between Russia and Finland to refugee boats near the Canary Islands.

Its other resources include satellite imagery, ship movements and even weather forecasts - data that national authorities can pull up at any time. “We deliver information about the situation on the borders for all of Europe in virtually real-time,” said one official, who asked to remain anonymous.

Frontex began its work in 2005 with a staff of 45 and a yearly budget of €6.5 million. Its mission was to coordinate Europe’s various national border agencies and establish common practices. Since then, its budget has grown to €254 million, with 359 employees. By 2020, it’s set to receive €320 million annually, an increase of 5,000 percent since its founding.

Today’s EBCGA helps manage joint operations by border agents of different E.U. countries, particularly in the Mediterranean region. Its primary job, however, is running the the continental border surveillance network Eurosur, which was started in 2013.

Another centerpiece of the bloc’s border protection program is based 1,200 miles away in an underground building behind a barbed-wire fence in eastern France. Known as eu-LISA, the program is also referred to as the “European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice.”

It houses 30 racks of servers, which are connected via secure lines and provide access points for the E.U.’s various national authorities. Of eu-LISA’s three databanks, the Schengen Information System is most central to the agency’s work. It contains information on some one million persons wanted by police, as well as 32 million visa applicants and more than 5 million asylum applicants.

Border agents in every E.U. country can access that data when inspecting a traveler’s documents. Meanwhile, there is already additional space reserved in eu-LISA’s bunker for three additional databases, which will include information on airline passengers and visitors from countries outside the bloc.

“We make sure that all member states get all of the data,” said Bernard Kirch, head of eu-LISA’s operations department. “Within five minutes, every new entry is available everywhere.”

The work continues 1,800 kilometers to the southwest, in Lisbon. The Portuguese capital is home to the European Maritime Surveillance Agency (EMSA), which has traditionally been in charge of security in the shipping sector.

Next year, however, agents there will have more work to do: Together with Portugal’s air force, EMSA will help manage an entire fleet of remotely controlled surveillance planes. Equipped with high-definition cameras, laser light capability, and infrared and radar sensors, the aircraft will be able to deliver information on smuggling operations and refugee boats around the Mediterranean in any kind of weather.

EMSA’s drone videos are part of a large-scale expansion of Europe’s external border security system. The European Space Agency and the European Fisheries Control Agency provide additional data, while on the national level, coordination centers, or NCC’s,  report activity along the borders in every member state.

The European Commission said it expects that the expansion plans will cost €240 million, but the authors of a study from the Heinrich Böll Foundation put the figure at more than €800 million.

The team of Investigate Europe found that the system has a number of problems. Last month, when reporters visited an office billed as Italy’s NCC in Rome, an employee said the center was was closed for renovations and in need of new software. This was the same explanation journalists were given in October.

By contrast, there was a flurry of activity at the operations center of Italy’s coast guard. Staff there work around the clock to monitor the country’s maritime borders and coordinate rescue operations involving thousands of migrants stranded in the Mediterranean Sea. When it came to Eurosur, however, none of the officers on duty had heard of it.

At Greece’s NCC, border and coast guard personnel provide Eurosur with information about what’s happening along the country’s shores, but much of it involves previous incidents. Even in Poland, near Europe’s border monitoring headquarters, it’s difficult to glean useful information, such as reports on Slovakian border checkpoints.

A 2015 investigation by France’s parliament concluded that the E.U.’s expensive Eurosur network failed to improve surveillance activities, citing the limits of its ability to work with real-time data. But Brussels has a very different assessment of the program.

In an interview with the Investigate Europe team, Dimitris Avramopoulos, the European Commissioner for Migration, Home Affairs and Citizenship, dismissed criticisms of Eurosur and insisted that the system is “doing a very good job.” The expansion of the European Border and Coast Guard Agency, he said, would make things “even better.”

The strategy of the European Commission, as well as interior ministers of Schengen countries, is based on the idea that more surveillance technology and data collection translate into more security. That idea has also helped feed a symbiotic relationship between E.U. officials and industry interests.

According to the independent Transnational Institute in Amsterdam, between 2007 and 2014, the E.U. invested more than €316 million in taxpayer money in new border surveillance technologies. Of the 15 businesses and organizations that received most of that funding, 11 belonged to the European Organisation for Security (EOS), an association founded by a former lobbyist with a defense electronics firm.

Friends of the industry have long had a strong presence within the European Commission’s consulting groups on border security. One third of these advisers had or still have ties to such sectors, creating major concerns about potential conflicts of interest.

While funding for research helps companies mitigate the risks that come with crafting new surveillance technologies, the real money is made once E.U. authorities mandate that Schengen members start buying those products. EOS had long been calling for Frontex to be expanded into an E.U. border protection agency capable of carrying out wide-ranging surveillance.

The migrant crisis in the Mediterranean provided further fodder for that argument. In a 2013 letter to the European Commission’s President, EOS wrote: “What happened recently in Lampedusa is just one example of the urgency in providing more and better tools for early detection and identification of critical situations and immediate response at sea.”

Europe’s external border protection strategy is also based on collecting an increasing amount of personal data. Though European parliamentary committees initially rejected a plan to store traveler information for five years, the tide shifted following the Paris terror attacks in 2015. After French politicians put pressure on parliamentarians in Strasbourg, the provisions were approved.

Implementing what's known as the Passenger Name Record directive will require E.U. countries to contribute a combined sum of more than €500 million to cover the costs of putting together the registry and ensuring national authorities can access it. There are lingering questions about PNR’s potential impact, however. Wojciech Wiewiorowski, assistant European data protection supervisor, said that so far “no one has demonstrated how the passenger data might be be made useful.”

E.U. officials are also working on an entry-exit system to be implemented at the 1,800 border crossings on Schengen countries’ outer borders. Instead of stamping passports, border agents at these checkpoints would be able to gather passport and visa information, as well as photos and fingerprints, electronically. They could then search for individuals sought by law enforcement and store information to a central database.

The European Commission said its “Smart Borders” program will speed up processing travelers even as their numbers increase, thanks to self-service machines and automatic doors.

Despite the European Parliament’s reluctance to endorse what one member described one of “these megalomaniac projects,” the European Commission has been eager to move forward. In 2015, it tasked eu-LISA and the consulting firm PWC with testing cameras, finger scanners and document readers at airports, land borders, seaports and trains.

In the Commission’s eyes, this was proof enough of Smart Borders efficiency. E.U. officials, as well as national interior ministers, haven’t been content to wait for parliamentary approval: Ten member states have already decided to draw on money from the Internal Security Fund to start implementing the program.

Members of the European Parliament, however, remain skeptical. “We will learn the names of the people who overstay their visas, but then no one knows where they are. So what then?” said Ska Keller, vice chair of the Green Party's parliamentary group. Portuguese MP Carlos Coelho agreed. “We only get a statistic,” he said. “Why should we install such an expensive system for that?”

The European commissioner, Mr. Avramopoulos, maintained that the program “meets citizens’ requirements for safety and security.” Brussels has estimated that the project will cost €480 million, but a parliamentary study said member states would likely face a total bill of more than €1 billion through 2027.

Meanwhile, the technology that Smart Borders uses appears to have its own drawbacks. In tests, biometric devices that compared passport photos with photos taken at the Stockholm airport worked only 39 percent of the time. The automatic border gates at Lisbon airport failed for one of every two passengers.

Investigate Europe’s team interviewed border agents in multiple Schengen countries who told them that the technology would actually make for a less secure system. “If there’s no longer someone looking at the older stamps in the passport, the travel histories aren’t being reviewed,” said one German federal police officer, who has worked at the Frankfurt airport for 20 years. “We’ll no longer find out if a person arriving from Thailand may have visited Iraq or Jordan beforehand.”

A Portuguese border agent, Marco do Carmo, told journalists that the devices are unable to perform crucial profiling tasks, such as “seeing how people react, seeing how they speak.” That, he said, is the only way to identify suspicious persons.

Biometrics expert Alexander Nouak from the Fraunhofer Institute for Computer Graphics Research also expressed doubts. “Getting through the e-gates quickly is only possible if the threshold for the photo comparison isn’t too high,” he said. And unlike border agents, machines are unable to determine whether a real passport has been issued illegally. “Only personnel asking questions can do that,” Mr. Nouak said, arguing that while the technology can make the job of border agents easier, it’s no replacement.

Biometric data isn’t the only information on travelers that Brussels is keen to obtain. Mr. Avramopoulos and the Commission’s first vice president, Frans Timmermans, also want visitors from countries outside the Schengen zone to register with E.U. authorities ahead of time. Draft legislation has already been prepared and other rules, including requirements to question travelers about their health, have been planned – despite the fact that they violate existing European privacy laws.

Brussels’ security strategy also foresees the integration of the E.U. border regime’s six databases into a larger system. The goal, Mr. Avramopoulos said, is “E.U.-wide biometric identity management,” which would allow a camera to identify any individual at any time.

The European commissioner further dismissed concerns about the legality of the program: “Europe’s databank system is in strict accordance with the constitutional laws of Europe.”


This story first appeared in Der Tagesspiegel and was written by Harald Schumann and Elisa Simantke. To contact the authors: [email protected]