If the Commissioner isn’t responsible for DG HOME’s alleged unethical and unlawful actions, who is?

Everything is “normal”, claims DG HOME

On 25 October 2023, EU Home Affairs Commissioner Ylva Johansson faced Members of the European Parliament (MEPs) in the civil liberties committee to respond to allegations of conflicts of interest and illegal advertising practices in relation to the controversial draft CSA Regulation.

In September, a series of allegations (here, here and here) were made by journalists that officials in the Commission’s DG HOME department had given undue access to certain stakeholders, including private companies, and hold external positions which may amount to a conflict of interest. This has occurred against the backdrop of a DG HOME legislative proposal which all formal legal opinions by EU institutions have warned would likely be illegal according to EU human rights law.

An additional revelation also showed that the Commission had targeted a series of adverts to people in countries whose governments opposed the proposal, using religious and political beliefs to find people they felt would be most susceptible to the advert’s emotionally manipulative claims. This would likely be unlawful under the EU’s Digital Services Act.

The response from the Commissioner at the MEP committee meeting was, however, characterised by evasion and opacity. This mirrors the refusal to engage with legitimate stakeholders and criticism that we have seen from DG HOME for the last two years. The Commissioner repeatedly protested that all steps taken by her department, DG HOME, were perfectly “normal”. This was met with incredulity from MEPs, who pointed out how deeply disturbing it would be if the Commission considers these practices to be normal.

Parliament finds political agreement in midst of Commission scandal

This committee meeting comes at a crucial time. The day before, MEPs working on the CSA Regulation announced that they had found political agreement on the Parliament’s position. If approved at committee vote, scheduled for 13 November, the Parliament’s political agreement seems set to improve significantly on the Commission’s dangerous and misguided original draft, addressing several of the key issues flagged by the EDRi network.

This reportedly includes adding in protections for end-to-end encryption, because the Parliament have rightly recognised the fallacy of DG HOME’s claim – repeated by the Commissioner at the committee meeting – that her proposal “is technologically neutral”. To the contrary, experts have been clear that it would undermine end-to-end encryption, a warning that the Parliament seems to have taken seriously.

If adopted, the Parliament position would also require reasonable suspicion for scanning private messages, and would delete AI-based grooming detection and mandatory age verification for private message services.

At the same time, there would still be problematic measures in this version of the proposed position. And given that the Commissioner continues to refuse to answer MEPs questions about possible interference with the democratic process, we remain disappointed that the Parliament will not send the law back to DG HOME to request a new proposal based in evidence and in compliance with fundamental rights law. This has been a long-running demand of 134 NGOs.

Concerns about AI company influence not addressed

Several MEPs at the committee meeting raised questions about the one-sided nature of DG HOME’s interactions and the privileging of certain stakeholders, including AI companies. Despite a year-long investigation from a trio of journalists backed up by countless interviews and freedom of information requests, journalist Apostolis Fotiadis pointed out that prior to this meeting, the Commissioner had publicly discredited their investigation.

During the committee meeting, several MEPs lamented the Commission’s failure to release documents – but the Commissioner replied that they would need the permission of the other party to do so. This seems to be an admission that Thorn – the “not-for-profit start up” at the center of DG HOME’s misconduct allegations – might be refusing to allow documents and correspondence to be made public. Given allegations that Thorn would profit from this law, it is even more important for the integrity of the democratic process that these documents are made public.

Debunking lies: has Commissioner Johansson met with digital rights groups?

EDRi was shocked to hear the Commissioner claim during the committee meeting that “we have consulted and listened to all of the stakeholders who have approached us […] what matters is the merit of their knowledge to help to find the right balance of this proposal”. Despite recently calling EDRi “the biggest digital rights NGO in Europe”, the Commissioner has repeatedly refused to hear our concerns. This seems to be an admission that she does not see merit in digital rights expertise.

When pressed by MEPs, the Commissioner also doubled down on DG HOME’s claim of a having taken a balanced approach, making the untrue statement that “I also met EDRi personally at a panel on this proposal”. Whilst it is correct that the Commissioner spoke at a panel that EDRi also spoke at, we are surprised that the Commissioner would misrepresent this as having met us personally or hearing to our views.

The Commissioner was equally problematic when asked by MEP Chagnon why she rejected an offer to meet with one of the largest child protection hotlines in the world, Dutch hotline Offlimits, despite being happy to travel to California to meet with tech companies. The Commissioner said that she “regrets” that she is too busy to meet everyone, but followed up with a cryptic comment that all stakeholders “also have their own agenda.”

Illegal targeting as “standard normal practice”

In the committee meeting, the Commissioner’s tone showed a dramatic shift regarding allegations of advert micro-targeting on the basis of prohibited characteristic, which watchdog NGOs have pointed out can undermine the democratic process and contribute to a shrinking of civic space.

The Commissioner posted a bombastic tweet at EDRi on 13 October claiming that DG HOME “have followed the guidelines & the law 100%” and that their actions are “standard normal practice.” Yet at the committee meeting, the Commissioner all but admitted that the European Commission has been micro-targeting adverts supporting the CSA Regulation on the basis of protected characteristics.

Clearly, MEPs were deeply frustrated with the Commissioner’s refusal to take accountability for the micro-targeting (instead blaming staff and contractors) and lack of meaningful answer – despite it having been two weeks since the allegations were first made. Ignoring the question from MEP Lenaers about why he wasn’t shown the advert as a Christian, the Commissioner instead protested that it “I am not responsible”.

If both the ends and the means are undemocratic, where does that leave us?

The undercurrent of Commissioner Johansson’s interventions seemed to be that the end justifies the means – even if the ends lack objective evidence of effectiveness, and if the means involve DG HOME allegedly colluding with industry, using micro-targeted adverts, avoiding critics and attempting to manipulate the democratic process.

Making sure to have the final word, Commissioner Johansson stated that the “core of this proposal is protection of children”, and seemed to criticise MEPs for not focusing on that point. Yet several child rights and child protection experts, as well as survivors of CSA, have pointed out the risk that the proposal could actually achieve the opposite effect.

There has been a well-documented and long-standing refusal by DG HOME’s to engage substantively with concerns that the proposal is disproportionate and based on a fundamental misunderstanding of technology, even attacking academics who pointed to the deep technological flaws.

We reiterate that the complex issue of CSA requires a nuanced and whole-of-society approach, whereas mass surveillance will make all of us less safe – including the children that this law is supposed to protect.

You can watch the full committee meeting here: https://multimedia.europarl.europa.eu/en/webstreaming/libe-committee-meeting_20231025-1430-COMMITTEE-LIBE