After record setting negotiations, four parties have finally presented a coalition in the Netherlands. There are a fair number of cyber security measures in the preliminary agreement, which will serve as a guideline for the government s term for the coming years.
Following the elections of 15 March1, three of the four larger parties in the Netherlands started coalition talks a task that was viewed as difficult from the start.
With the Liberal Democrats and Christian Democrats as the largest parties, it would be difficult to reach consensus with the biggest winner Green Lefts and the centre-democratic Democrats 66 (D66). After Green Lefts eventually dropped out of the coalition talks, a new attempt was made with the Christian Union, a painfully slow negotiation process that was concluded on 10 October with a coalition agreement.
As opposed to a few years ago, the new agreement has a rather large number of sections on IT security pointed out by many in the industry by counting the use of the term cyber , which appeared eight times in the 70-page document that outlines the new government s plans for the country over the next four years. An important factor for adding so much IT to the agenda would be D66, the centre party with MP Kees Verhoeven2 as a well-known spokesperson for the digital agenda.
Law on intelligence and security-agencies
Of particular interest in the agreement are amendments to the controversial law on intelligence and security agencies3, which will go fully into effect on 1 January 2018. A group of petitioners recently successfully collected enough signatures4 to start a national referendum to try to rescind the law, which would give intelligence agencies the power to use dragnet methods for collecting information on many people in a single area . Most criticism of the law revolves around the supervision of an accountability taskforce, of which some is too vague.
Even though the WiV will go into effect regardless of the outcome of the referendum, the new coalition has decided to evaluate the law within two years . If the supervision is indeed not enough, the law can be altered if necessary.
Use of zero days
Another controversial law, the Computer Criminality Act III, will also be slightly altered . Newly detailed plans in the agreement specifically mention the use of zero-days by law enforcement5, and gives stricter rules for police and intelligence agencies to use these. Specifically, zero-day-technology can only be bought and used if required for very specific cases . Also, vendors of such software will be screened by the Dutch national intelligence agency AIVD to make sure software is not also sold to dubious regimes . As with the WiV, this policy will now also be evaluated every two years, and law enforcement has to release statistics on the use of zero-days on a yearly basis.
A lot of these measures are seen as both good and bad by experts . Good, because a new evaluation clause has been added and several safeguards have been built in to prevent abuse . But privacy activists had hoped for more severe measures like scrapping parts of the laws entirely.
Investing in the country s digital capacity
The coalition plans to spend an extra ‘ 95m to lay out an ambitious cyber security agenda and to increase the country s digital capacity . The new funds will be divided among several departments like the Ministry of Security and Justice, Defence, Foreign Affairs and Interior. An extra investment of ‘ 275m a year will be put into digital forces within the Dutch army, starting 2020, to increase cyber capacity in the armed forces. A particularly increasing role will be designated for the National Cyber Security Center6 (NCSC), which advises the private sector on security practices and will be taking on a bigger role in preventing cyber crime and attacks in the future. Also new is the intention to make revenge porn illegal, or the posting online of pornographic material of an ex as a way of revenge after a bad breakup .
This would probably be broadened to any form of posting nudity online of other persons, though the agreement keeps the terms vague most likely to allow for interpretation. A particularly high-profile case of revenge porn dominated the Dutch technology news earlier this year, as a young girl sued Facebook for refusing to hand over information on who uploaded a video of her . The case got some international attention when Facebook, after a long legal battle, was ordered to hand the information over7 in 2015.
Storing of email addresses
Hidden away somewhere else in the agreement is the addition of email addresses in the Municipal Personal Records (the Basisregistratie Personen), with little more details given other than that email addresses will be stored safely and encrypted . There’s also a small line about increasing the security of DigiD, the digital login system Dutch citizens can use to login to government services to do their tax returns or view their student loans . There have been talks for years about replacing DigiD in favour of a new system called eID8, which has been in an experimental phase for a while but has not been rolled out yet.
Internet of things security standards
For suppliers, the coalition plans to introduce security standards for internet of things appliances9, though how these standards are to be implemented remains to be seen . This had been a longstanding wish of D66. The agreement also mentions a possible import ban for appliances that don t follow security practice, although was not detailed.
The coalition agreement is so far just an agreement the four main parties have set up, but it s far from definite . The new coalition will be small with a majority of only one, with 76 seats in a house of 150. The parties ideals are also far apart, so only a few dissidents in the coalition might mean a law could fail to pass.
However, after more than eight months of negotiations, Dutch MPs will probably not be looking for hard internal clashing.
- ^ the elections of 15 March (www.theguardian.com)
- ^ Kees Verhoeven (twitter.com)
- ^ controversial law on intelligence and security agencies (pilpnjcm.nl)
- ^ successfully collected enough signatures (nltimes.nl)
- ^ the use of zero-days by law enforcement (www.computerweekly.com)
- ^ National Cyber Security Center (www.ncsc.nl)
- ^ was ordered to hand the information over (www.computerweekly.com)
- ^ a new system called eID (joinup.ec.europa.eu)
- ^ introduce security standards for internet of things appliances (searchsecurity.techtarget.com)
Next week is the Gartner Security and Risk Summit in London and Splunk is going to be there together with our customer Yoox. If you didn t see the news, Yoox and Net-a-Porter are merging and Gianluca Gaias, their Head of Information Security, will be presenting how they are using Splunk to build an enterprise-grade Security Intelligence Platform. If you re at the Summit, Yoox is presenting on Tuesday 15th at 10:15 in the Westminster A room.
The Security Summit follows on from the recent Gartner SIEM Magic Quadrant where Splunk was named a leader. You can get a free copy of the report here1. There s also a short video that gives you an overview of Splunk for Security:
We re very lucky to have Haiyan Song, Splunk s Senior Vice President of Security Markets, as well as members of the Security Behavior Analytics Team team at the event.
If you didn t see the news, Splunk recently acquired Caspida2 to add behavioral analytics to the Splunk security portfolio. This allows organizations to better detect advanced and insider threats by looking at user behavior to spot unusual trends. Recent high-profile breaches show virtually all attacks happen with compromised credentials, and automated detection leveraging machine learning is the future for detecting known and unknown threats from insider and external attackers.
Splunk customers now have out-of-the-box user behavioral analytics to help detect, respond to and mitigate these threats.
There s a good EMEA customer story from Telenor about using Splunk for security.
We also have a great on-demand webinar on the subject of Best Practices for Scoping Infections and Disrupting Breaches4 .
Hopefully see you at the Gartner Security Summit.
As always, thanks for reading.
SURREY, B.C. The bullets fell from the sky.
Police say that s just one of several flippant explanations offered to authorities from those targeted in a callous spate of shootings that have been frightening residents east of Vancouver in the past five weeks.
Police in Surrey and Delta declared on Tuesday that two ethnic gangs warring for territory in low-level drug trafficking are responsible for the staccato of violence.
In a rare move, authorities have released the names and photos of victims in the shootings, asking for the public s help for the safety of residents and because they say no one is co-operating in their investigations.
Mounties have determined 11 of 19 shootings that have sent bullets into homes and vehicles are related to groups of South Asia and Somalian descent. No one has died.
We believe these two groups are competing over turf and have chosen to jeopardize public safety in that process, said Chief Supt.
Bill Fordy, with Surrey RCMP.
Police have arrested one person, Delta resident Arman Dhatt, 18, and charged him with 12 firearms and drug trafficking offences. They ve also seized one suspect vehicle.
Fordy said in a statement to media that police are using overt and covert techniques to gather intelligence and evidence, and many tips have helped them to identify several previously unknown people related to the gangs.
But Fordy said the victims who have been questioned by police have only provided replies such as, I will take care of it myself, and Don t you worry about it. No need for you cops to be here.
He said the two sides are determined to settle their differences outside of the law.
As you can imagine, this lack of co-operation has significantly impacted our ability to make any arrests, Fordy said.
The recent attacks began March 9, when a 20-year-old man was dropped off at a Surrey hospital suffering gunshot wounds.
They weren t able to figure out what happened and the man was released.
Within two days, a series of five more shooting incidents erupted including a drive-by involving two cars unleashing bullets at four men in another car.
One victim was shot in the neck.
Police held a news conference on March 12 that helped them identify eight more men who they say were either victims or intended victims.
None of the men has come forward with information and now they are publicizing their names and photographs, police say.
The names released by police are Adam Lakatos, Derrick Bequette, Chadanjot Gill, Shakiel Basra, Sukhpreet Pansal, Sukhraj Chahal, Tirath Taggar and Charandeep Tiwana, all from Surrey or Delta.
Those names are combined with a list of five other men police identified during a news conference last month.
Fordy asked members of the public to contact police if they know anything about any of the shootings.
Acting Chief Lyle Beaudoin, of the Delta Police Department, said the brazen nature of the shootings in residential and other public locations where members of the community should feel safe is hugely concerning and our utmost priority.
Fordy said police are speaking to elders and leaders in the Somali and Sikh communities, have gotten involved in a Sikh youth pilot program in area temples and have interviewed many of the men s family members.
A record-high number of murders in 2013 prompted the City of Surrey to create a crime task force asked to find solutions to the municipality s high crime rate.
The team recommended adding 24 police officers over two years and a bike squad, expanding the surveillance camera program and using licence plate readers to identify stolen cars.
Follow @TamsynBurgmann on Twitter