The SWIFT Affair|
1. The International Dimension of the SWIFT Affair
- 1 http://www.swift.com (accessed on 8 June 2009).
1In 1973, a consortium of international banks founded SWIFT (Society for Worldwide Interbank Financial Telecommunication) with the goal to transfer standardized messages between different actors in the financial sector. SWIFT has since developed into the pivotal electronic postal service for the financial industry. The worldwide SWIFT network nowadays carries 14 million messages per day, or 3.5 billion messages per year. Half of the traffic consists of traditional payment messages. The network has 8900 users in 209 countries. Europe accumulates the most SWIFT traffic, with 68.9% of worldwide traffic, while North and South America account for 19.9% of SWIFT messages.1
2SWIFT has a quasi-monopoly position for international financial transactions. Almost any international transaction in the regular banking sector goes through the SWIFT network and SWIFT servers. The two main data operation centers are located in Zoeterwoude (Holland) and Culpeper (Virginia, USA). For security reasons and to prevent data loss, every message is processed simultaneously on both continents and saved for 124 days. (see Annex 1 for more information on the history, the functioning and the importance of SWIFT)
3Based in Belgium, SWIFT is a non-profit cooperative society under Belgian law. It is owned and controlled by its shareholder. The shareholders elect a board of 15 directors every three years who govern the Company. The directors are mostly managing directors of important central and private banks. Both major Swiss banks, UBS and Credit Suisse, each appoint a director. The board of directors oversees the Leadership council consisting of full-time employees headed by a Chief Executive Officer. (SWIFT By Laws 2004) Voting shares on the Board of directors are proportional to the annual contribution made by the respective financial institute.
- 2 The G-10 central banks are: Bank of Canada, Deutsche Bundesbank, European Central Bank, Banque de (...)
4Although SWIFT is vital to the global financial system, it is technically neither a payment nor a settlement system and therefore not directly regulated by bank supervision or a central bank. However, since a SWIFT network breakdown would entail the collapse of our modern financial system, central banks of the Group of Ten countries2 (G 10) decided in 1998 that SWIFT should be subject to their cooperative oversight. Since SWIFT is incorporated in Belgium, the National Bank of Belgium acts as the lead overseer. The oversight of SWIFT is based on a dialogue of good faith and mutual trust. Or, in the words of the National Bank of Belgium “the major instrument for the oversight of SWIFT is moral suasion”. There is no binding legal framework for SWIFT oversight. No G10 central bank has the authority to enforce sanctions, fines or changes of practices upon SWIFT. (Financial Stability Review 2005) Apparently, this has never been required since SWIFT has always acted cooperatively. Additionally, central banks could influence SWIFT by informing their member banks about concerns related to SWIFT. The oversight activities are outlined in a protocol between the National Bank of Belgium and SWIFT. The relationship between the National Bank of Belgium and the other central banks is specified in bilateral non-binding Memoranda of Understanding.
- 3 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite au (...)
5Given its factual monopoly on financial transactions, it is easy to imagine that tapping into SWIFT would be a childhood dream for many intelligence officers. After the 1998 US embassy bombings in Dar es Salaam and Nairobi, the CIA and the US Department of Treasury (UST) approached SWIFT, demanding access to the SWIFT network. (Mintz 1998) At the time SWIFT refused to cooperate with the UST for the following three reasons: First, SWIFT was able to show that US authorities can obtain the relevant data more efficiently through the emitting or recipient bank. Second, SWIFT did not have the technical capacity to perform searches in their operation centers. The third reason for non-cooperation was that the actual events at the time of the UST demand partially occurred over a period of time longer than 124 days. Therefore, the data would have been only of limited use. 3
- 4 The term “Terrorist Financing Tracking Program” (TFTP) to describe the SWIFT database search was i (...)
- 5 Apart from legality issues, the fact that US authorities chose an official way of monitoring SWIFT (...)
6In 2001, shortly after 9/11, a Wall Street executive told a senior Bush administration official about the SWIFT database. (Lichtblau and Risen 2006) Quickly realizing the possibilities of monitoring a financial database of such scope, the Bush administration officials were eager to gain access. According to the Los Angeles Times, the CIA developed a clandestine way in the late 1990s to access the SWIFT network. (Meyer and Miller 2006) In October 2001, the CIA pushed to enhance the covert surveillance of SWIFT, while the Treasury Department wanted to provide a legal basis for a SWIFT surveillance program. The legal strategy prevailed, and within weeks after 9/11, the secret “Terrorist Financing Tracking Program”4 (TFTP) was established.5
7The program functions as followed: The Office of Foreign Assets Control (OFAC), which is part of the Treasury Department, issues subpoenas to the SWIFT data processing center in the US. These subpoenas define which messages SWIFT has to transfer to the Treasury Department. The selected messages are then copied from the SWIFT server in the US and transferred to the UST where they are searched for predetermined names and accounts.
- 6 (2008). Contrôle et procédure de recommandation initiés à l’égard de la société SWIFT scrl C. d. l (...)
8Media reports from 2006 suggest that the program is “run out of the Central Intelligence Agency and overseen by the Treasury Department”. (Lichtblau and Risen 2006) The amount of data that the US authorities were and are accessing is not precisely known. SWIFT acknowledged that the first searches were conducted on the entire SWIFT database, since all messages within a certain period of time were transferred to the Treasury Department. Subsequent subpoenaswere narrower, limiting the transferred message to specific dates and specific countries of origin or destination.6 US Treasury officials say that nowadays “less than one percent” of worldwide SWIFT traffic is searched. One percent would amount to 140’000 financial transactions searched every day.
9SWIFT servers store messages only for 124 days. The US Treasury Department initially kept the transferred files and the search results for an indefinite period of time. Treasury shares the gained information with the CIA, the FBI, and analysts from other agencies who can run queries on persons believed to have terrorist connections. (Simpson 2006)
- 7 The Treasury Department’s undersecretary stated that the program was used only to examine records (...)
10The actual search methods used are contested and the different accounts diverge. US authorities assure media and SWIFT that no “data mining” or “fishing” has taken place. But those terms are vague, and the US authorities have not further defined them.7 According to former Treasury Secretary John Snow, the program is “not a fishing expedition” but rather “a sharp harpoon aimed at the heart of terrorist activity”. (Meyer and Miller 2006) The Washington Postand the Belgian Privacy Commission stated that the initial searches after 9/11 were very broad and could have included “data mining”, but were subsequently narrowed.
- 8 (2006). Testimony of Stuart Levey, Under Secretary, Terrorism and Financial Intelligence U.S. Depa (...)
11On September 23, 2001, President Bush declared the terrorist threat a national emergency by signing executive order 13224. This declaration of emergency has since been renewed annually. Based on the US International Emergency Economic Power Act of 1977, the government has the right “to compel the production of information pursuant to the Presidential declarations of national emergency.”8 The US Treasury Department therefore has the right to issue administrative subpoenas (administrative orders) to receive information helpful in the fight against terrorism. Those subpoenas are secret and are not subject to review by any judge or jury. (Meyer and Miller 2006)
12The Treasury Department has been issuing a monthly subpoena to SWIFT, ordering them to reveal and transmit transaction messages. Legally, this was possible due to the fact that SWIFT, a Belgian cooperative, has a data operation center situated in the US.
13The use of subpoenas is a common tool and subpoenas have been used widely before 9/11. However, what is new since the SWIFT surveillance is the scope of the subpoenas. Usually, an administrative order allows access to specific individual transactions or accounts. In the case of SWIFT surveillance, the Treasury Department issues one subpoena to access millions of messages.
14In 1976, the US Supreme Court ruled that Americans have no constitutional right to privacy over their banking records. Following that decision, US Congress passed the “Right to Financial Privacy Act” in 1978 to re-establish privacy rights for US bank customers. (Connorton 2007) The Financial Privacy Act, however, has a limited scope and its role in national security cases remains largely untested. Some US government lawyers have argued that obtaining access to SWIFT data without a warrant might be illegal. (Lichtblau and Risen 2006) But after an initial debate, Treasury Department lawyers, consulting with the Justice Department, concluded that the privacy laws did not apply to SWIFT, since it is a banking cooperative and not a bank. The Treasury Department argues that SWIFT is exempt from American laws restricting government access to private financial records since the cooperative is a messaging service, not a financial institution. Mr. Levey, the Treasury Undersecretary commented on the decision: “People do not have a privacy interest in their international wire transactions”.
15It appears that the Treasury has acted in conformity with US law. SWIFT has not questioned the use of administrative subpoenas in US courts, and neither has anybody else. It is therefore unlikely that we will see a definite answer to the question of conformity with US law. As long as the subpoenas remain unchallenged in court, SWIFT is obliged by US law to comply with the data revelation asked for in the administrative subpoenas.
- 9 (2007). IAN WALKER and STEPHEN KRUSE, Plaintiffs, v. S.W.I.F.T. SCRL, Defendant. A. D. United Stat (...)
16US lawyers have nevertheless tried to sue SWIFT for violating their privacy rights under the Financial Privacy Act. Ian Walker and Stephen Kruse filed a class action lawsuit in a federal court the same day that the New York Times revealed the program, on 26 June 2006. They claimed that the US federal executive branch violated their privacy rights by obtaining their financial data through the SWIFT network. A federal district court of first instance in Chicago allowed the case to be tried. SWIFT then transferred the case to Virginia, where the judge dismissed it in October 2007.9 The court ruled that there was no base for the suit, since the plaintiffs provided no proof that their personal data was directly targeted by the SWIFT surveillance. The lawsuit was hindered by another fact: the Treasury Department announced in August 2007 that it would invoke the state secrets privilege to protect any data protection lawsuit against SWIFT. (Lichtblau 2007) Thus, it is most unlikely that SWIFT or the Treasury Department will ever be successfully sued for privacy violations.
1.4 Compatibility of SWIFT surveillance with Belgian and European law – the role of the Belgian Privacy Commission
17Most European countries have created data protection authorities responsible for monitoring regulation implementation and reviewing complaints. However, many European data protection authorities do not have the competencies to issue binding orders. They mostly operate through “name and shame” tactics, or refer cases to courts or state prosecutors. Contrary to events in the US, no court has ruled on the accordance of the SWIFT surveillance with Belgian or European law. Yet the data protection authorities, with the “Belgian Privacy Commission” taking the lead, have been very active in investigating the SWIFT case. The proceeding of the Belgian Privacy Commission over the past three years is an excellent illustration of how European data protection authorities can actively enhance privacy for their constituencies, despite the fact – or perhaps owing to the fact – that they cannot issue binding orders.
- 10 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux (...)
- 11 (2008). Opinion 10/2006 on the processing of personal data by the Society for Worldwide Interbank (...)
- 12 The “Article 29 Data Protection Working Party” is also a consultancy body that can adopt only advi (...)
18The Belgian Privacy Commission issued its first detailed report on the SWIFT surveillance in September 2006, less than three months after the New York Times revealed the secret program. In a combative report, the Commission concluded that SWIFT violated Belgian and EU law by complying with the Treasury Department’s subpoenas: “[It] must be considered a serious error of judgment on the part of SWIFT to subject a massive quantity of personal data to surveillance in a secret and systematic manner for years without effective grounds for justification and without independent control in accordance with Belgian and European law.”10 Of particular significance was the fact that SWIFT failed to inform all affected parties that is was disclosing their financial data. The commission further criticized SWIFT for chastely complying with the administrative subpoenas. In November 2006, the Commission’s findings were confirmed at the European level by the “Article 29 Data Protection Working Party” of the European Union.11 The EU Working Party affirmed the Belgian findings that the transmission violated EU law.12 However, since the Belgian Privacy Commission is unable to directly initiate any legal procedures, it could only ask the Belgian public prosecutor to initiate legal procedures. For his part, the prosecutor announced in December 2006 that he would not take any legal action. It is not uncommon for the Belgian public prosecutor to abstain from taking legal action on the recommendation of the Belgian Privacy Commission. This lack of response has been explained as being caused by a general overload of work. (Fuster, De Hert et al. 2008)
19No other Belgian authority has shown willingness to take legal action on the matter. In fact, Belgian Prime Minister Guy Verhofstadt even called the program an “absolute necessity”.
20On the other hand, the Belgian Privacy Commission did not abandon the subject, and it continued its investigations over the course of the following two years to assess the legality of the surveillance program. After an extensive information exchange with SWIFT, the Commission issued its final verdict on 9 December 2008. Contrary to its first report in 2006, the second report cleared SWIFT of all charges.
- 13 More specifically resolutions 1267, 1333 and 1373. Especially resolution 1373 states that all coun (...)
21What led the Commission to reverse its previous finding? In legal terms, the Commission found that the surveillance was in accordance with several UN Security Council resolutions, a fact which they had not considered in their first report.13 Indeed, the President of the Security Council resolution 1267 Committee even stated in a report on 4 December 2002 that “the settlement of international transactions is usually handled through correspondent banking relationships, such as SWIFT […] The United States has begun to apply new monitoring techniques to spot and verify suspicious transactions. The group recommends the adoption of similar mechanisms by other countries.” This report was distributed to UN member states.
22However, conformity with UN Security Council resolutions was not the principal factor for the reversal of the Commission’s earlier finding. Of greater importance were the considerable efforts undertaken by SWIFT between 2006 and 2009 to enhance the protection of their customers’ data (see chapter 2.5). The final verdict of the Belgian Privacy Commissionclearly states that the Commission was pleased with SWIFT’s cooperation and efforts: “one might say, in any event, that it [SWIFT] adopted a prudent, diligent and attentive conduct, amid the stakes involved, to the protection of personal data transferred from the European Union”.
23The proceeding of the Belgian Privacy Commission demonstrates that European data protection authorities can actually use the fact that they issue non-binding findings to their advantage. The Belgian Privacy Commission’s first report was a shot across the bow. The commission initially condemned SWIFT in its first report by labelling the network’s actions as illegal. The resulting media pressure, and the loss of reputation that this entailed encouraged SWIFT to take all possible measures to better protect the data of their European customers. SWIFT did so, amongst other measures, by building a third data operation center in Switzerland. Once SWIFT had proven that its commitment to data protection was serious, the Belgian Privacy Commission revoked its initial findings and cleared SWIFT from most of its allegations.
- 14 A search of the complete database (1986-2006) of the Neue Zürcher Zeitung, one of the major Europe (...)
- 15 Details can be found on http://www.swift.com/index.cfm?item_id=6149 (accessed June 8, 2009).
24To claim that SWIFT is an organization that stays out of the headlines would be an understatement. SWIFT has over 2000 employees in 55 countries. It organizes a seminar once a year with 6’000 participants. And it is a crucial, if not the most important, link in the global financial market. Yet, SWIFT’s public profile prior to 2006 was as low-key as possible. SWIFT hardly ever appeared in the press14 and other than the term “SWIFT-Code”, few people outside the banking industry knew much about it. The company nurtures that image by applying a “no comment policy”15. SWIFT’s relationship with government authorities is intimate and relies on good faith.
- 16 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux (...)
25This close relationship of good faith and the desire to keep a low public profile are two factors that may assist in understanding why SWIFT never questioned the administrative order from the US Treasury Department. The decision to comply with the subpoenas was made in 2001 by SWIFT’s CEO, its board of directors, and its Audit and Finance Committee. SWIFT then informed the G10 oversight group of national banks of the data transfer to the US Treasury.16
- 17 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux (...)
26SWIFT broadly cooperated with the US authorities in 2001 and did not question the data search. Although some SWIFT managers had reservations, they saw the measure as a temporary means for assisting the investigation into the terrorist attacks of 9/11. (Lichtblau and Risen 2006) The US Treasury assured SWIFT that the data would be used only for terrorism investigations. Use of the data for investigations on tax fraud, drug trafficking or other inquiries would be prohibited. However, the US Treasury Department’s definition of terrorism is rather broad: “…la lutte contre des attentats de terroristes contre les Etats-Unis qui ont eu lieu après le 11 septembre 2001 et un réseau global de cellules terroristes qui constitueraient un risque de violence accrue contre les ressortissants, les propriétés et les intérêts américains et les intérêts nationaux et étrangers”.17
27In 2002, as the surveillance program was appearing to become permanent, SWIFT officials addressed the Treasury Department to improve and clarify data protection measures. In particular, SWIFT demanded that the search results, on which SWIFT had no information, were to be reviewed by an independent auditor. The Treasury Department then mandated the audits of the search results to Booz Allen Hamilton Inc., a prominent defense and intelligence consulting and engineering firm.
- 18 Further description by the Washington Post : “When President Bush wonders whether the Pentagon sho (...)
- 19 Ibid.
28However, Booz Allen Hamilton is not an independent auditor. It is described by the Washington Post as “one of the government’s main contractors”18. Military and intelligence contracts are their main source of revenue. They have been involved in some of the most ambitious federal surveillance programs such as the Total Information Awareness Program. Other mandates include Spy-Software development for the FBI and lobbying with other major companies for “more information sharing”.19 The Vice President of Booz Allen Hamilton is James Woolsey, the former CIA director; the Senior Vice President is Mike McConnell, the former director of the NSA. This firm has been auditing the Intelligence results from the SWIFT surveillance since 2002.
- 20 One SWIFT official recalls the meeting in the New York Times as being a “full-court press”. (Licht (...)
29In 2003, SWIFT demanded further government guarantees from the US and received a letter of comfort from the Treasury Department in which Treasury declared that it would support SWIFT in the event foreign authorities ever questioned SWIFT’s decision to comply with the subpoenas. Apparently, this was only cold comfort to SWIFT. In late 2003, SWIFT officials began discussing the possibility of pulling out of what they once saw as a temporary measure. Shortly after, the US administration asked SWIFT executives and some board members to come to Washington. There, they met with Alan Greenspan, Robert S. Mueller, the FBI director, and Treasury officials.20 SWIFT officials, apparently impressed by the all-star line-up, agreed to continue to transfer data but demanded further assurances.
- 21 The new definition is arguably narrower and makes no reference to “American interests”. The renego (...)
- 22 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux (...)
30On 27 February 2004 an agreement was signed which assured SWIFT that the original source of the data (i.e. SWIFT) would be kept confidential by the US Treasury Department. Another provision tightened the confidentiality commitment of the search results by US intelligence agencies. The broad definition of ‘terrorism’, which constitutes the basis upon which the US Treasury conducts searches, was also narrowed.21 In addition, from April 2004 onwards, two SWIFT officials were allowed to be physically present when the CIA searched the data provided by SWIFT. The purpose of that measure seems limited, since the two SWIFT officials neither had access to the search software nor to the search results.22
- 23 See chapter 1.6.
- 24 SWIFT’s official press release is available on (2006). “EU Parliament hearing: SWIFT statement and (...)
31Once the surveillance program was made public by US newspapers in 2006,23 SWIFT tried to stick to its “no comment policy”, despite public pressure. Very little information was made available except for statements that SWIFT had fully complied with both European and US law. When the Belgian Privacy Protection Commission commenced its investigations, SWIFT finally decided to share some information on the program with the Commission. On 4 October 2006, the SWIFT Financial Officer Francis Vanbever had to appear before the European parliament in order to explain SWIFT’s position.24 During that hearing, Francis Vanbever explained that SWIFT “strongly objected” to the opinion of the Belgian Data Privacy Commission that it had broken Belgian and EU Privacy laws. The SWIFT CFO then went on to urge EU and US officials to find a solution that would allow SWIFT to better comply with European privacy laws, even though he had stated only moments earlier that SWIFT had not violated any laws.
- 25 The complete agreement is published in the US Federal Register Vol. 24, No. 204/Tuesday, October 2 (...)
32The United States and the European Union engaged in negotiations thereafter, which resulted in an agreement regarding the SWIFT surveillance program on 27 June 2007. In the compromise, the US agreed on five points. First, the US would use data obtained through the program exclusively for counterterrorism purposes. Second, the US would delete data unrelated to counterterrorism on an ongoing basis. Third, the US would retain data for no more than 5 years. Fourth, the US would allow an EU official to monitor the program. And finally, the US would publish the concluded agreement in the Federal Register. This was subsequently done by the Treasury Department.25 This compromise was criticized in the US for hampering US counterterrorism efforts by deleting unrelated data on an ongoing basis. (Connorton 2007)
33In order to gain legal protection, SWIFT decided to join the “Safe Harbor” agreement in April 2007. This was a rather curious move. The “Safe Harbor” was created for US companies doing business in Europe. US firms adhering to the “Safe Harbor” data protection principles were rewarded with the certainty that their data transfers are considered legal in the EU. However, the “Safe Harbor” agreement guaranteed a lower level of data protection than the law of EU member states. SWIFT, being a Belgian company, was theoretically already subject to the stricter EU laws, the added value by adhering to “Safe Harbor” was therefore unclear. (Fuster, De Hert et al. 2008) The adherence to “Safe Harbor” was nevertheless presented as a political ‘solution’ by US and EU authorities.
- 26 (2007). “SWIFT Board approves messaging re-architecture.” Retrieved May 12, 2008, from http://www. (...)
- 27 Interview with high-ranking SWIFT official, summer 2008.
34More importantly, however, was the internal reaction within SWIFT. In 2007, SWIFT announced that it would change the structure of its network.26 It would create two message processing zones: one European, the other Trans-Atlantic. This meant that European traffic would be separated from the rest of the world. Concretely, this meant that intra-European traffic in which the emitter and recipient are located inside the European Union would stay inside Europe and would therefore not be accessible by the US surveillance. This would “help overcome data protection concerns”. SWIFT announced that it would install a new Operation Center for intra-European traffic in Switzerland which should be operational by the end of 2009. According to SWIFT, the choice of location was due to the high level of Swiss data protection provided in law and the availability of qualified labor. (yr 2008) The new SWIFT data operation center is located in the greater area of Zürich, Switzerland. The exact location is secret. (Flubacher 2009) Each SWIFT country representative was presented with two options for the location of future financial data processing activities. The options were: “The Netherlands and Switzerland” or “The Netherlands and the US”. Most countries chose the European option, while only a few, such as Australia, decided to continue processing their data in the US. (yr 2008)27
35This move towards a closed European circuit for SWIFT messages indicates that impact of external pressure. It is interesting to ask who demanded an intra-European network. Even though no lawsuit was filed in Europe, it is possible that member banks were becoming increasingly worried about their legal obligations. European public authorities could also have been at the root of those demands, fearing a public backlash for failing to protect civil liberties and bowing to US demands. And finally, the Belgian Privacy Commission has also contributed its share.
36SWIFT engaged in further minor measures to enhance data protection and reestablish public trust. SWIFT created an internal “Data Protection Working Group” and elaborated an extensive “SWIFT Personal Data Protection Policy”. The public SWIFT website now contains extensive information on SWIFT’s functioning, especially concerning data protection.
37The secret SWIFT surveillance was made public on 23 June 2006 in newspaper articles published in the New York Times (Lichtblau and Risen 2006), the Los Angeles Times (Meyer and Miller 2006) and the Washington Post. (Simpson 2006) Apparently, the New York Times was the first newspaper to decide to publish the story. The revelation of the SWIFT surveillance program was immediately followed by fierce criticism by Republican senators, the Bush administration, and right-wing circles in the US. President Bush called the newspaper story “disgraceful and a great harm to security. There should be no excuse for anyone entrusted with vital intelligence to leak it and no excuse for any newspaper to print it.” (OConnor 2006) The Chairman of the House Homeland Security Committee, Republican Peter T. King, urged the Bush administration to seek criminal charges against the newspaper. (Barret 2006) Right-wing radio commentators like Melanie Morgan even called on the prosecution of the NY Times Editor Bill Keller for treason under the Espionage Act, and to have him executed. Bill Keller responded in an open letter to the criticism, arguing that the revelation is not a security breach, since it did not disclose information, such as troop locations, that would clearly compromise the immediate safety of individuals. (Editorial “New York Times” 2006) According to Keller, the White House has “trumpeted that the US makes every effort to track international financing of terror”, therefore the revelation of the surveillance program did not lead terrorists to change their tactics.
38In the US, critics of the revelation seemed to heavily outweigh its supporters, at least in the popular media. Unlike in Europe, there was no public outcry about the program. Many conservative media outlets kept the story alive, condemning the New York Times for disturbing US counterterrorism efforts by drawing awareness to the surveillance program. Of course, by doing so, the conservative media coverage had exactly the same effect; it spread the word about the “secret” program even further.
39By fall 2006, public opinion turned so decidedly against the New York Times that on 22 October, the New York Times’ public editor, Byron Calame, wrote a Mea Culpa. He stated that he was “off base” and that it was a mistake to reveal the SWIFT surveillance program. Two factors apparently brought him to this conclusion: the first factor was that the program apparently is legal in the United States; secondly, there was no evidence that anyone’s private data had actually been misused. Calame still thinks that the program lacks appropriate oversight, but he came to the conclusion that the other two factors were more important. Therefore, he expressed his regret that the NY Times ever published the story.
2 The G-10 central banks are: Bank of Canada, Deutsche Bundesbank, European Central Bank, Banque de France, Banca d’Italia, Bank of Japan, National Bank of Belgium, De Nederlandsche Bank, Sveriges Riksbank, Swiss National Bank, Bank of England and the Federal Reserve System (USA), represented by the Federal Reserve Bank of New York.
3 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux sommations de l’UST (OFAC). C. d. l. p. d. l. v. p.-R. d. Belgique, Commission de la protection de la vie privée – Royaume de Belgique. AVIS No 37 / 2006 du 27 septembre 2006.
4 The term “Terrorist Financing Tracking Program” (TFTP) to describe the SWIFT database search was introduced by Treasury secretary John Snow after the revelation of the program in 2006. Before that, the media referred to the surveillance program as the “SWIFT program”, a term which continues to be common.
5 Apart from legality issues, the fact that US authorities chose an official way of monitoring SWIFT has technical advantages: Contrary to covert surveillance where messages have to be filtered out in real time, a legal surveillance program searches can be carried out on the entire database.
6 (2008). Contrôle et procédure de recommandation initiés à l’égard de la société SWIFT scrl C. d. l. p. d. l. v. p.-R. d. Belgique, Commission de la protection de la vie privée – Royaume de Belgique. Décision du 9 décembre 2008.
7 The Treasury Department’s undersecretary stated that the program was used only to examine records of individuals and entities (Lichtblau and Risen 2006).
8 (2006). Testimony of Stuart Levey, Under Secretary, Terrorism and Financial Intelligence U.S. Department of the Treasury, Before the House Financial Services Subcommittee on Oversight and Investigations. U. D. o. Treasury. July 11, 2006.
9 (2007). IAN WALKER and STEPHEN KRUSE, Plaintiffs, v. S.W.I.F.T. SCRL, Defendant. A. D. United States District Court for the Eastern District of Virginia. 517 F. Supp. 2d 801; 2007 U.S. Dist. LEXIS 77803. 1:07cv635: 517-525.
10 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux sommations de l'UST (OFAC). C. d. l. p. d. l. v. p.-R. d. Belgique, Commission de la protection de la vie privée – Royaume de Belgique. AVIS N° 37 / 2006 du 27 septembre 2006.
11 (2008). Opinion 10/2006 on the processing of personal data by the Society for Worldwide Interbank Financial Telecommunication (SWIFT). E.-A. D. P. W. Party. Brussels, EU.
12 The “Article 29 Data Protection Working Party” is also a consultancy body that can adopt only advisory opinion with no binding effect.
13 More specifically resolutions 1267, 1333 and 1373. Especially resolution 1373 states that all countries shall “afford one another the greatest measure of assistance […] including assistance in obtaining evidence […] and find ways of intensifying and accelerating the exchange of operational information”.
14 A search of the complete database (1986-2006) of the Neue Zürcher Zeitung, one of the major European business newspaper found exactly 5 articles which had information about SWIFT. And all of them mentioned SWIFT only in a side sentence.
16 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux sommations de l’UST (OFAC). C. d. l. p. d. l. v. p.-R. d. Belgique, Commission de la protection de la vie privée – Royaume de Belgique. AVIS N° 37 / 2006 du 27 septembre 2006.
17 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux sommations de l'UST (OFAC). C. d. l. p. d. l. v. p.-R. d. Belgique, Commission de la protection de la vie privée - Royaume de Belgique. AVIS N° 37 / 2006 du 27 septembre 2006.
18 Further description by the Washington Post : “When President Bush wonders whether the Pentagon should take over the CIA’s paramilitary functions, Booz Allen Hamilton is the company that the Pentagon turns to for an answer (the company concluded that the spy agency should keep its paramilitary force). When the Air Force wants to study how best to get information from a battleground to a fighter jet, it turns to Booz Allen Hamilton with the $9 billion job. With such clients, Booz Allen, which marked its 90th anniversary last year, is mum about much of its business.” (2005). “Booz Allen Hamilton Inc.” Retrieved 12 May 2008, 2008, from http://www.washingtonpost.com/wp-srv/business/post200/2005/BAH.html.
20 One SWIFT official recalls the meeting in the New York Times as being a “full-court press”. (Lichtblau and Risen 2006)
21 The new definition is arguably narrower and makes no reference to “American interests”. The renegotiated definition goes as follows: Terrorism is “an activity that (i) involves a violent act or an act dangerous to human life, property, or infrastructure; and (ii) appears to be intended (A) to intimidate or coerce a civilian population; (B) to influence the policy of a government by intimidation or coercion; or (C) to affect the conduct of a government by mass destruction, assassination, kidnapping, or hostagetaking. This includes, but is not limited to, activities engaged in by known terrorist organizations, but excludes activities of recognized governments.
22 (2006). Avis relatif à la transmission de données à caractère personnel par la SCRL SWIFT suite aux sommations de l’UST (OFAC). C. d. l. p. d. l. v. p.-R. d. Belgique, Commission de la protection de la vie privée – Royaume de Belgique. AVIS N° 37 / 2006 du 27 septembre 2006.
23 See chapter 1.6.
25 The complete agreement is published in the US Federal Register Vol. 24, No. 204/Tuesday, October 23, 2007. The document is accessible under http://frwebgate6.access.gpo.gov/cgi-bin/PDFgate.cgi?WAISdocID=584782474622+1+1+0&WAISaction=retrieve (retrieved June 04, 2008)
27 Interview with high-ranking SWIFT official, summer 2008.
© Graduate Institute Publications, 2011