On 5 April 2017, the Norwegian government proposed an amendment to the Norwegian code of criminal proceedings to allow the police to compel the use of biometric authentication. After two quick debates, the Norwegian Parliament passed the proposition into law on 21 June.
Article 199 of the Norwegian code of criminal proceedings reads as follows after the change:
“When searching an electronic system the police can demand from anyone with connection to the system the necessary information to gain access to the system or open it by biometric authentication.If anyone refuses a demand for biometric authentication as proposed in the first sentence, the police may perform the authentication by force.The decision to use force
If anyone refuses a demand for biometric authentication as proposed in the first sentence, the police may perform the authentication by force.
The decision to use force by the second sentence is decided by the prosecutor’s office. If there is a risk that would be brought about by delaying the authentication, the decision can be made by the police on the spot. The decision shall immediately be reported to the prosecutor’s office.[…]”
The lack of specificity of an “electronic system” means this law has an extremely wide scope. We can, for example, envision that access to a personal device such as a mobile phone, which stores the access credentials to several cloud storage services, essentially gives away a more or less complete description of a person’s life. To entrust such decision to a single police officer with no due process means that an act with very far reaching consequences may be performed in a matter of seconds. EDRi member Electronic Frontier Norway (EFN) is exploring the possibility that this may violate the privacy protections afforded by Article 8 of the European Convention on Human Rights (ECHR) and the right to avoid self-incrimination afforded by Article 6.
There is also no reference to proportionality of the use of force. Although there is no reason to suspect this would be used in a disproportionate way, the lack of such a limitation means that we don’t know how far the use force might be taken. While the use of torture is prohibited by the Norwegian constitution, such lack of specificity in an individual law risks creating a situation where an overzealous officer may deem it necessary to perform acts which are prohibited by other parts of the law. It is not obvious how the law may be applied for example when iris scanning is involved. Logically, force must be applied in close proximity to the eyeball and eye socket, which puts an individual at obvious physical risk.
It is also important to take note that the law is not limited to suspects but “anyone with connection to the system”. This means that someone with no connection to a crime may be subjected to the abovementioned uses of force.
EFN is worried about the development this and other changes to the law in the same direction represents. This law has been rushed through without proper justification, and the wording has been chosen with apparently little or no regard to proper scope.
Norwegian code of criminal proceedings (only in Norwegian)
https://lovdata.no/dokument/NL/lov/1981-05-22-25/KAPITTEL_4-3#%C2%A7199
Forced biometric authentication in Norway (26.07.2017)
https://efn.no/1807/forced-biometric-authentication-in-norway
(Contribution by Tom Fredrik Blenning, EDRi member Electronic Frontier Norway)
