Romanian version of EU cybersecurity directive allows warrantless access to data

The law could impact international businesses, as Romania is a hub for IT outsourcing and development

More than a dozen Romanian non-governmental organizations are protesting new cybersecurity legislation passed by the parliament last week that would force businesses to provide the country's national intelligence agencies with access to their data without a court warrant.

The law could also impact businesses from Europe and beyond, as Romania is a hub for IT outsourcing and software development. Many multinational corporations including Amazon, Microsoft, Adobe Systems, Siemens and Intel have research and development centers in the country.

The law, which only lacks the president's signature to come into effect, is based on the European Union's upcoming Network and Information Security (NIS) Directive, a legislative framework that aims to strengthen cybersecurity across the E.U., particularly in key areas like critical infrastructure.

An amended version of the proposed NIS Directive was approved by the European Parliament in March. It requires member states to develop national cybersecurity strategies and appoint central authorities in charge of coordinating the response to cyberthreats and incidents.

It also creates new requirements for operators of critical infrastructure, like those in the energy, transport, banking, financial market or health sectors, to assess the risks they face and to adopt appropriate measures to ensure the security of their networks and information. They will also have to report incidents to the national cybersecurity authorities.

Critics of the new Romanian law claim that it is overly broad, likely unconstitutional and ignores the E.U. recommendation that the authority responsible for national cybersecurity should be a civilian body not linked to law enforcement, intelligence or national defense.

Unlike the NIS Directive, which focuses on operators of critical infrastructure, the Romanian bill applies to all organizations, public or private, that own, administer, operate or use cyberinfrastructures. Cyberinfrastructure is defined in the law as "infrastructure in the field of information technology and communications, consisting of information systems, related applications, networks and electronic communication services."

This means the law would apply to all public institutions, private companies and other legally established organizations that operate computers and networks.

"One company with one computer cannot represent a national cybersecurity problem," the Romanian Association for Technology and Internet (ApTI) said in a blog post. The law must apply only to public and private entities that are identified as operators of critical infrastructure of national importance and they should be clearly listed in the law, the organization said.

ApTI is a member of European Digital Rights (EDRi), a pan-European association of digital rights organizations.

Another problem is that the law requires companies to provide the Romanian Intelligence Service (SRI) -- the Romanian equivalent of the U.S. National Security Agency -- and a half-dozen other government agencies with assistance and access to their data based only on a "motivated request," not a court order.

The agencies that could request data in this manner, according to art. 17 of the law, are the Romanian Intelligence Service, the Ministry of National Defence, the Ministry of Foreign Affairs, the National Registry Office for Classified Information, the Foreign Intelligence Service, the Special Telecommunications Service, the Protection and Guard Service, CERT-RO and the National Authority for Management and Regulation in Communications (ANCOM).

ApTI and other civil society organizations believe this would violate the constitutional rights of citizens, since many companies and organizations process and store data about or generated by private individuals.

"Who decides if these requests are sufficiently motivated and which data are relevant?" ApTI said. "Why not a judge, as currently stipulated in the code of criminal procedure?"

The third issue with the current form of the law is that it designates SRI as the national authority in charge of cybersecurity. This appears to contradict the EU NIS Directive, which says that: "The competent authorities and the single points of contact should be civilian bodies, subject to full democratic oversight and should not fulfil any tasks in the field of intelligence, law enforcement or defence or be organisationally linked in any form to bodies active in those fields."

Thirteen non-governmental organizations, including ApTI, sent a letter Monday to Romania's new president, Klaus Iohannis, as well as the Romanian Parliament, the Romanian High Court of Cassation and Justice and the People's Advocate, urging them to officially ask the Constitutional Court to review the law. This is a required procedure before the Constitutional Court can rule whether a law violates basic constitutional rights.

Another option would be for the president not to promulgate the law and return it to the Parliament for reexamination.

"Since his first day in office, the President is faced with a situation where he can prove his commitment for the respect of human rights in Romania," the letter said.

Join the CSO newsletter!

Error: Please check your email address.

Tags amazonGovernment use of ITsecurityMicrosoftadobelegislationgovernmentinteldata protectionprivacy

More about Adobe SystemsEUEuropean ParliamentIntelMicrosoftNational Security AgencySiemensTechnology

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place