The Dutch Intelligence and Security Law, set to be enacted July 1st, lacks promised oversight staff, undermining the rule of law.
The law expands SIGINT capabilities to all forms of communication on Dutch internet exchanges, including private peering and PNI, with potential data sharing with foreign intelligence agencies.
Full intercept requests will be judged primarily on technical completeness rather than merit, reducing regulatory oversight.
The law is universally applicable, offering no special privacy protections for Dutch or EU persons, unlike US law.
Powers include observing, hacking, intercepting communications, and algorithmic analysis, with minimal oversight for non-targets and third parties.
Proposed changes increase powers: exploratory cable interception for one year without justification, strategic hacking without risk assessment, and expanded warrant extensions to non-targets.
Algorithmic analysis on bulk data no longer requires regulatory approval, contradicting European Court of Human Rights requirements for safeguards.