CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
24. The FRA may collect electronic signals also in order to monitor
changes in the international signals environment, technical advances and
signals protection and to develop the technology needed for signals
intelligence (section 1(3)). This is regarded as “development activities” and,
according to the relevant preparatory works (prop. 2006/07:63, p. 72), they
do not generate any intelligence reports. Signals intercepted in the context
of the FRA’s development activities do not interest the authorities for the
data they might contain but only for the possibility to analyse the systems
and routes through which information is transmitted. The FRA may share
experiences gained on technological issues with other authorities.
Development activities usually do not focus on communications between
individuals, although information on individuals’ identities may be
intercepted.
25. Signals intelligence conducted on cables may only concern signals
crossing the Swedish border in cables owned by a communications service
provider (section 2). Communications between a sender and receiver within
Sweden may not be intercepted, regardless of whether the source is airborne
or cable-based. If such signals cannot be separated at the point of collection,
the recording of or notes about them shall be destroyed as soon as it
becomes clear that such signals have been collected (section 2a).
26. Interception of cable-based signals is automated and must only
concern signals that have been identified through the use of selectors (or
“search terms”). Such selectors are also used to identify signals over the
airways, if the procedure is automated. The selectors must be formulated in
such a way that the interference with personal integrity is limited as far as
possible. Selectors directly relating to a specific natural person may only be
used if this is of exceptional importance for the intelligence activities
(section 3).
27. The preparatory works to the Signals Intelligence Act (prop.
2006/07:63, p. 90) clarify that the exceptional importance requirement
under section 3 is needed in view of the fact that the use of search terms that
are attributable to a particular individual, such as personal names, telephone
numbers, email or IP addresses, involves special risks from a privacy
protection perspective. The use of such search terms should only be
considered under special conditions and should be preceded by a thorough
necessity assessment, notably, as to whether the information which can
thereby be obtained is of such importance that it justifies the measure. As an
example, the text refers to the following hypothetical situation: a national
crisis caused by an IT attack against systems of crucial importance to
society where immediate action needs to be taken to identify the individual
actors.
28. After the signals have been intercepted they are processed, which
means that they are, for example, subjected to cryptanalysis or translation.
7