top of page

The hacking law with its own backdoor

In the past few years, Dutch EDRi member Bits of Freedom has put a lot of effort into trying to stop the Dutch hacking proposal. The proposal would grant Dutch law enforcement agencies the authority to remotely access electronic devices. In December 2016, the law was passed in Dutch Parliament. Sadly, without the improvements that the law desperately needed. The legislative process The plans for this bill became public in 2012. In June 2013, a bill was launched for public consultation. After that, things settled down for quite a while, until December 2015, when the bill was sent to Parliament. After a public hearing and a very short time frame for the political parties to give their opinion and submit their questions, it got quiet again in February 2016. Too quiet for the VVD (liberals) and the CDA (Christian democrats). They repeatedly inquired why the answers to their questions took so long and demanded a swift process. They also put the bill on a fast track in Parliament – even without their questions answered by the government. The answers finally came in November 2016, in a 134-page report. In many ways, this created more confusion rather than answered any questions. It was no surprise that procedural mechanisms were used by the coalition of PvdA (social democrats) and the VVD (liberals) to push ahead with the vote on the bill, pushing aside requests from the opposition to get clarification on the report. On 13 December 2016, the Parliament debated the bill. A week later, on 20 December, they voted in favour of adopting the proposed bill. It will now be debated in the Senate. The substance The law will allow law enforcement agencies to hack into any electronic device. These devices may or may not be connected to the internet. After accessing the device – and based on the court order – they are allowed to, for example, search the device, to activate applications (including webcams and microphones), to copy or delete data. Law enforcement agencies are allowed, after a court order, to access these devices through several means, including the use of vulnerabilities. --------------------------------