Networks of in security

The “war on terror” long ago disappeared from western newspaper headlines. Yet it is still very much with us, driving the development of transnational systems for state surveillance and control. Despite the rise in geopolitical conflict and competition between states, this transnational security architecture has broad support from governments across the globe.

It is comprised of systems for the surveillance of international travel, the digital reinforcement of borders, and interconnected state ‘watchlists’, often using experimental and untested technologies. It offers governments new ways to pursue and punish dissidents and activists across borders, whilst making it harder for individuals to access justice and redress. And it is being constructed with little – if any – popular knowledge, oversight or consent.

New forms of safety and security, not premised on surveillance and control, are necessary. The transnational security architecture is hiding in plain sight. It is time to take notice, and take action.

Malé, the Maldives, June 2019. It is a typically hot day in the capital of this Indian Ocean state. Officials have gathered for the launch of a new police database. It will gather data on the millions of people who travel in and out of the country by air every year.¹ The system’s developers claim it can “automatically… identify suspicious travelers or crewmembers who may pose a national security risk.” ²

In September, a similar project is launched in Baku, Azerbaijan. ³ That same month, an official visit by the Parliamentary Assembly of the Council of Europe finds that “Azerbaijan has a problem of political prisoners… this problem is due to structural and systemic causes.” ⁴ This is part of a broader repressive apparatus that involves “rigid” state control of political activity. ⁵

Manila, the Philippines, July 2021; the midst of the coronavirus pandemic. Over a grainy webcam transmission, a government official announces a new plan “to detect and interdict known and suspected terrorists and criminals using passenger data.” ⁶ A year earlier, a new Anti-Terrorism Law came into force in the country. ⁷ It has been used “against activists, Indigenous peoples, unionists, as well as alleged communist insurgents.” ⁸

Abuja, Nigeria, June 2024. After interconnecting a swathe of national and international policing databases, the Nigeria Immigration Service “can now pre-profile anybody before the person gets into Nigeria,” says Olubunmi Tunji-Ojo, the interior minister. Data on travellers will be analysed in what he describes as “one of the best command centres anywhere in the world.” ⁹ The development comes at a time when activists and advocates are facing “persistent and growing official intimidation.” ¹⁰

Each of these governments has their own motives and rationales for setting up these systems. Nevertheless, they are part of an international effort – a long-term plan to create a transnational security architecture premised on automated data collection, algorithmic profiling and widespread data-sharing within and between governments.

There are three key parts of this digital infrastructure:

• systems for monitoring and profiling international travellers;
• biometric identity databases; and
• government watchlists, for tracking individuals of interest to the authorities.

The information collected and generated by these systems is supposed to be shared between government agencies both domestically and internationally. ¹¹

This architecture is being introduced in the name of fighting terrorism and serious crime. It will do nothing to address the fundamentals of either. Yet it will undermine peoples’ rights, whilst providing governments around the world with new means of surveillance, control and repression. As the last 25 years of the “war on terror” have demonstrated, the term ‘terrorist’ is notoriously open to abuse by governments seeking to crack down on dissent, opposition, or ‘undesirable’ activities.

There are four areas of particular concern:

• the use of experimental technologies that undermine people’s rights;
• the effects of reinforced and reconfigured state borders;
• the provision of surveillance and control technologies to authoritarian and undemocratic regimes; and
• the difficulty of obtaining redress for abuses or errors.

Many of the technologies and techniques being deployed for the transnational security architecture are experimental. For example, states increasingly use rules-based screening and network analysis tools to analyse travel data [link to travel surveillance piece], gathered from people making international journeys by plane and, increasingly, boat. Next in line are road and rail travel.

Through rules-based screening, someone can be flagged for monitoring, questioning or arrest if they fit certain “rules.” This might be related to age, gender or travel route, or a combination of these and other factors. ¹ Passengers’ networks can be mapped out with their data, by looking at who else they travel with; what other tickets their credit card has been used to buy; or the journeys they have taken in the past.

Wherever they are deployed, systems that rely on automated screening and profiling reflect the biases, racism and discrimination of the societies that produce them – problems that are particularly pronounced in the fields of policing, counter-terrorism, criminal justice and immigration. ² States, international organisations and private companies are nevertheless exploring ways to further ‘upgrade’ these systems using ‘artificial intelligence’ and machine learning technologies. ³

Simpler uses of travel data may also have serious consequences for people. If a person’s data matches a record in a database, they may face invasive searches, questioning, deportation or even denial of travel. Yet errors in spelling or transliteration, or simply sharing the same name with someone else, can easily lead to individuals being wrongly-identified.

As these databases continue to grow, and increasing efforts are made to interconnect them both nationally and internationally, these problems are likely to get worse. States may also seek to integrate information on peoples’ social media activity, financial transactions, education and employment history, family members and social networks, amongst other things. ⁴ To try to find needles in a haystack, governments are building a bigger haystack and relying on experimental technologies to support the search.

The push to more closely monitor people making international journeys is part of a broader effort to reinforce and reconfigure state borders. In 2018, Kevin McAleenan, Commissioner of US Customs and Border Protection, referred to this as “extending our zone.” ¹ Elsewhere, the phrase “pushing the border out” has come into common use amongst officials. ² The term preferred by critics is “border externalisation.” ³

The purpose is to remove the state’s point of control over individuals to a place as far away as possible from the state’s territory. Sometimes this is done by financing border guards and border patrols in foreign states. Sometimes it is done through digital infrastructures of control. ⁴ (The flipside is the extension of border controls within states’ territories, something also facilitated by digital technologies. ⁵)

Vetting and screening travellers to determine if they should be allowed to make a journey is a form of government “permission to travel.” ⁶ The Universal Declaration of Human Rights includes “the right to leave any country, including [their] own,” a provision included in response to European dictatorships stopping their citizens from fleeing. Your own government should not prevent you from leaving your country – but it is increasingly the case that the government of another country can.

Infrastructure at states’ territorial borders is also being reinforced, in particular through the use of biometric identity systems that capture fingerprints and faces of travellers. International organisations are providing this infrastructure to a growing number of governments around the world, with financial support from wealthy countries.

Those who need to leave a country for their own safety already face multiple barriers to doing so, particularly if their destination is in the west. Refugees are rarely granted visas, fuelling the market for human smuggling as people seek to cross borders irregularly – either by entering a state undetected, or by using false or fraudulently-obtained documents. Yet the harder those borders are to cross, the more dangerous peoples’ journeys become, placing them at greater risk of violence and harm.

For those who can travel ‘legally’, the risks are not so great. Nevertheless, the increasingly-integrated border control and travel permission systems being introduced by states are premised on the collection of large amounts of sensitive personal data. That data may, in turn, lead to unwarranted stops, searches, questioning, detention, or denial of permission to travel; while affected people may have few, if any, rights to seek redress.

The transnational security architecture is premised on a global system of surveillance and data exchange that increases the state’s ability to monitor and control people’s movements; to glean knowledge about people’s contacts and associates; and to crack down on dissent and protest. To put it in place, training, technical advice, policy guidance, hardware and software are being provided to democracies, dictatorships, and all shades of government between the two.

The domestic effects of the systems examined in this research remain under-explored, though there is some evidence to suggest they are already being misused by nominally-democratic states. Germany is suspected of having used air travel data to prevent an anti-fascist from travelling to a meeting abroad. ¹ The British police’s acquisition of air travel data may well be behind the recent detention of a journalist upon his return to the UK. ² The acquisition of rail travel data may also have played a part in the detention of a French publisher by British police last in April 2023. ³

The transnational security architecture will facilitate increased transnational repression. This has been defined as “governments reaching across borders to silence dissent among diasporas and exiles, including through assassinations, illegal deportations, abductions, digital threats, Interpol abuse, and family intimidation.” ⁴ As noted, Interpol’s systems are already widely (mis)used for these purposes. ⁵ With more states being connected to those systems, new information-sharing networks being put in place, and more governments with an authoritarian bent coming to power, the trend seems likely to continue without serious, sustained opposition.

The transnational security architecture is predicated on the cross-border exchange of personal data about millions of people. It is only by sharing information and intelligence, so the theory goes, that states can capture and punish increasingly-mobile terrorists and criminals. Thus, the decisions of one state – for example, to label someone a terrorist – need to be enforced by another.

Yet should that individual seek access to the information used to label them a terrorist, or have it corrected or deleted, they might find that their rights – unlike their data – remain firmly stuck at the borders of the nation-state. For example, if you are a non-US citizen labelled a suspected terrorist or criminal by US authorities, you have few, if any, means of redress. The 1974 Privacy Act is only applicable to US citizens and permanent residents. The law has been described as “so limited and riddled with exceptions that it is almost worthless.” ¹

This is not the case everywhere. The EU, for example, extends to all individuals the right to access, correct or delete personal data that is held on them within its jurisdiction. Some other states do the same. Yet there are many exceptions to those rights and remedies. Furthermore, paper and practice are two different things: anyone seeking to exercise their rights in another country will need language skills and legal knowledge, or funds to pay for both. For many, neither will be within reach.

Even when an individual is able to exercise their rights to access, correction or redress, their data may already be in a database or on a watchlist in another jurisdiction. Seeking meaningful redress in such a situation, without any globally enforceable right to do so, would appear to be nigh-on impossible. Even the most minimal means for accountability – the right to seek redress for wrongdoing – is not being extended to counterbalance the globalisation of the state’s repressive apparatus.

From the Maldives and Azerbaijan to the Philippines and Nigeria, the transnational security architecture is being supported by a dizzying array of states, international organisations and agencies. The Maldives’ new traveller vetting software was developed by the USA’s Customs and Border Protection agency (CBP), which also provided training for 24 customs, police, immigration and police officials in the country. Further support came from the Japanese government and the World Customs Organisation (WCO), “an independent intergovernmental body whose mission is to enhance the effectiveness and efficiency of Customs administrations.” ¹

The Azerbaijani project was supported by the UK Border Force and the International Organization for Migration (IOM), a United Nations (UN) agency. The project was financed by the IOM Development Fund, “a unique global resource aimed at supporting developing Member States in their efforts to strengthen their migration management capacity.” ²

The IOM is not the only UN agency supporting the Azerbaijani government’s efforts. The country is a beneficiary of the Countering Terrorist Travel Programme, run by the UN’s Office of Counter Terrorism (UNOCT). The Philippines ³ and Nigeria ⁴ are also beneficiaries of the programme. The three countries have signed secret memoranda of understanding with UNOCT. These allow “the delivery of comprehensive technical assistance” to develop “capabilities to detect and intercept terrorists and serious criminals by using travel information.” ⁵

Underpinning the developments in these states, and many others around the world, are binding global legal obligations. The ostensible purpose of this was, initially, to detect and track known, suspected and alleged terrorists. A UN Security Council resolution from 2014, introduced in the midst of global concern over people travelling to join the so-called Islamic State, targeted “foreign terrorist fighters.” A 2019 resolution widened the scope of the project to countering “organised crime, whether domestic or transnational.” ¹

[graphic: UN SC resolutions]

The implementation of these legal obligation is supported by an ‘alphabet soup’ of multilateral and international organisations and agencies who provide support, advice, training and equipment.

Guidance, “toolkits” and “best practice” documents are a key way in which the tools, techniques and tactics of the transnational security architecture are shared between states.

The Biometrics Institute is a “a unique multi-stakeholder community” that seeks to “promote the responsible, ethical and effective use of Biometrics and related technologies.” ¹ It has drawn up “recommended practices for the responsible use and sharing of biometrics in counter-terrorism,” ² which have received the stamp of approval from UN bodies. ³

The Global Counter Terrorism Forum is an “informal, apolitical, multilateral” initiative that was set up by the USA in 2011. It has developed multiple toolkits and guidance documents on “watchlisting”, border controls and a wide array of other topics. [4] Its work has also received Security Council approval. ⁴ Indeed, large parts of a GCTF paper on foreign terrorist fighters were reproduced in the UN Security Council’s 2014 resolution dealing with the same topic. ⁵

International law and standards also play a key role in the attempt to introduce uniform policies and practices across states.

The International Civil Aviation Organisation (ICAO) recently approved changes to the Chicago Convention on civil aviation. These were pushed for by UN counter-terrorism bodies and western governments. They are designed to ensure worldwide use of systems for the surveillance of air travel, and the profiling of air passengers.

Air travel is not the only target, however. New standards are also being put in place for maritime travel. The World Customs Organisation (WCO) and the International Maritime Organisation (IMO) have both worked to develop international standards for this purpose. International rail and road travel are likely to be the next target for security officials. [link to travel surveillance piece]

The transnational security architecture is also being implemented through “capacity-building,” training workshops, and “roadmaps” that help shape national law, policy and practice.

The Organisation for Security and Cooperation in Europe (OSCE) has 57 member states and describes itself as “the world’s largest regional security organization.” Following a 2016 decision, ⁶ it has supported 12 countries in setting up travel data collection systems. These include the authoritarian state of Uzbekistan and the outright dictatorship of Turkmenistan. ⁷

The OSCE also supports “regional informal working groups” to foster cooperation and the sharing of “best practices” between states that have, or are setting up, travel surveillance systems. ⁸ The working groups cover Eastern Europe, Western Africa, Southern Africa, the states of the Caribbean Community (CARICOM) organisation, Asia, and the Middle East and North Africa.

The UNOCT’s Countering Terrorist Travel Programme is the most notable form of UN assistance, supporting member states in setting up travel surveillance and passenger profiling systems. Support can include help with drafting legislation, guidance on using an “intelligence-led, risk-based approach,” and training on “watchlisting, rules-based targeting and network analysis.”

A separate UN body, the Counter-Terrorism Executive Directorate (CTED), has since 2001 conducted more than 200 “assessment visits” to 119 UN member states. These are used to examine the extent to which countries have implemented Security Council resolutions on terrorism.

The provision of software and hardware for the collection, sharing and analysis of data is another means by which the transnational security architecture is developed.

The Countering Terrorist Travel Programme offers states “deployment, installation and maintenance of the ‘goTravel’ software,” ⁹ which was donated to the UN by the Netherlands. It enables surveillance and profiling of passengers, and information exchange with other agencies and states. The software can also be used to collect maritime travel data. According to the UNOCT, it has a ‘hit rate’ of just 0.008%, raising serious questions over its necessity and proportionality.  [link to travel surveillance piece]

In a similar move, the USA donated its Global Travel Assessment System (GTAS) to the World Customs Organisation. It is currently deployed in the Maldives, Pakistan, Uganda, Bermuda and Cambodia. ¹⁰ The US donates other software on a bilateral basis, with some two dozen countries currently using it. Both systems can be used for maritime as well as airline data. ¹¹

There are also numerous private companies offering “solutions” for processing travel, biometric and biographic data through risk assessment and algorithmic screening systems. WCC promises its customers “new rule-based targets based on machine learning algorithms.” ¹² Travizory boldly claims to be “revolutionizing border intelligence” through the use of artificial intelligence. The company makes the rather unlikely-sounding claim that combining data from API, PNR and e-visa systems “can increase border security by 20x.” ¹³ IDEMIA ¹⁴ and PnrGo ¹⁵ are other players in this developing market.

Other entities are offering the hardware and software needed to set up biometric border control systems. The International Organization for Migration can provide states with the Migration Information and Data Analysis System (MIDAS). It describes this as “a high-quality, user-friendly and fully customizable Border Management Information System.”

In 2018, 20 countries were using the system. Research for this project indicates that it is now in place at the borders of more than 50 states. Canada, Denmark, Germany, Japan and Norway, as well as the EU, are providing funding for the programme. ¹⁶

[graphi: Operation start dates]

The US offers foreign states with the Personal Identification, Secure Comparison and Evaluation System (PISCES). This is described by the US State Department as a “computerized watchlisting system.” According to a US government agency, it “enables immigration officials in countries at risk of terrorist activity to identify the attempted travel of known or suspected terrorists,” seemingly by allowing participating countries to mutually search lists of suspected terrorists. ¹⁷

In recent years the US has sought to “expand and improve PISCES.” The plan was to provide it to more countries, integrate “watchlisting and biometrics technology and programs, and to incorporate emerging technologies to defeat increasingly sophisticated efforts by terrorist networks to travel.” ¹⁸ PISCES, like MIDAS, can be integrated with the UN’s goTravel software. The US also has multiple direct data-sharing agreements with dozens of foreign governments, which allow direct bilateral connections between biometric and other databases.

[graphic: US data-sharing agreements]

There have been some notable challenges to aspects of the transnational security architecture.

In the US, numerous individuals have challenged their inclusion on the No Fly list, albeit with little success. Furthermore, they have largely sought to remove the individual in question from the No Fly list, rather than to challenge the legality of the list itself.

In the EU, the introduction of travel surveillance systems was blocked by MEPs in the European Parliament for years. They eventually caved in after a spate of terrorist attacks and under heavy government pressure. ¹ A subsequent legal challenge should have seen national systems substantially reformed, though little action has been taken. The law itself also remains intact, with its fundamental flaws unaffected. ²

There is no magic wand that can be waved to replace the systems of monitoring and control that are being introduced. Doing so will require long years of work: research and investigation; outreach and organising; building new alliances within and between countries; and multiple different forms of action suited to different political and social contexts.

The very fact that this architecture is being developed and deployed largely through transnational policies and projects requires different ways of thinking about how to challenge national state legislation and policy. Even establishing the bare minimum – global rights to remedy and redress – is a huge task. The first step, however, is to map the contours of power that are emerging, to facilitate critique, challenge and opposition. We hope that this work makes a useful contribution to that task.