More than a dozen Romanian non-governmental organizations are protesting new cybersecurity legislation passed by the parliament last week that would force businesses to provide the country’s national intelligence agencies with access to their data without a court warrant.
The law could also impact businesses from Europe and beyond, as Romania is a hub for IT outsourcing and software development. Many multinational corporations including Amazon, Microsoft, Adobe Systems, Siemens and Intel have research and development centers in the country.
The law, which only lacks the president’s signature to come into effect, is based on the European Union’s upcoming Network and Information Security (NIS) Directive, a legislative framework that aims to strengthen cybersecurity across the E.U., particularly in key areas like critical infrastructure.
An amended version of the proposed NIS Directive was approved by the European Parliament in March. It requires member states to develop national cybersecurity strategies and appoint central authorities in charge of coordinating the response to cyberthreats and incidents.
It also creates new requirements for operators of critical infrastructure, like those in the energy, transport, banking, financial market or health sectors, to assess the risks they face and to adopt appropriate measures to ensure the security of their networks and information. They will also have to report incidents to the national cybersecurity authorities.
Critics of the new Romanian law claim that it is overly broad, likely unconstitutional and ignores the E.U. recommendation that the authority responsible for national cybersecurity should be a civilian body not linked to law enforcement, intelligence or national defense.
Unlike the NIS Directive, which focuses on operators of critical infrastructure, the Romanian bill applies to all organizations, public or private, that own, administer, operate or use cyberinfrastructures. Cyberinfrastructure is defined in the law as “infrastructure in the field of information technology and communications, consisting of information systems, related applications, networks and electronic communication services.”
This means the law would apply to all public institutions, private companies and other legally established organizations that operate computers and networks.
“One company with one computer cannot represent a national cybersecurity problem,” the Romanian Association for Technology and Internet (ApTI) said in a blog post. The law must apply only to public and private entities that are identified as operators of critical infrastructure of national importance and they should be clearly listed in the law, the organization said.
ApTI is a member of European Digital Rights (EDRi), a pan-European association of digital rights organizations.
Another problem is that the law requires companies to provide the Romanian Intelligence Service (SRI)—the Romanian equivalent of the U.S. National Security Agency—and a half-dozen other government agencies with assistance and access to their data based only on a “motivated request,” not a court order.
The agencies that could request data in this manner, according to art. 17 of the law, are the Romanian Intelligence Service, the Ministry of National Defence, the Ministry of Foreign Affairs, the National Registry Office for Classified Information, the Foreign Intelligence Service, the Special Telecommunications Service, the Protection and Guard Service, CERT-RO and the National Authority for Management and Regulation in Communications (ANCOM).
ApTI and other civil society organizations believe this would violate the constitutional rights of citizens, since many companies and organizations process and store data about or generated by private individuals.
“Who decides if these requests are sufficiently motivated and which data are relevant?” ApTI said. “Why not a judge, as currently stipulated in the code of criminal procedure?”
The third issue with the current form of the law is that it designates SRI as the national authority in charge of cybersecurity. This appears to contradict the EU NIS Directive, which says that: “The competent authorities and the single points of contact should be civilian bodies, subject to full democratic oversight and should not fulfil any tasks in the field of intelligence, law enforcement or defence or be organisationally linked in any form to bodies active in those fields.”
Thirteen non-governmental organizations, including ApTI, sent a letter Monday to Romania’s new president, Klaus Iohannis, as well as the Romanian Parliament, the Romanian High Court of Cassation and Justice and the People’s Advocate, urging them to officially ask the Constitutional Court to review the law. This is a required procedure before the Constitutional Court can rule whether a law violates basic constitutional rights.
Another option would be for the president not to promulgate the law and return it to the Parliament for reexamination.
“Since his first day in office, the President is faced with a situation where he can prove his commitment for the respect of human rights in Romania,” the letter said.