BRUSSELS — As the EU plans to strengthen Europol's capabilities in the era of artificial intelligence, senior European officials warn that this must not come at the expense of Europeans' privacy protection.
Facing cybercriminals, terrorists and spies who use artificial intelligence to carry out scams, extortion and cyberattacks, Brussels is betting on strengthening Europol's AI skills — the agency that has coordinated European police intelligence since 1998 — to combat these threats.
"Europol is at a turning point," stated Fabienne Keller, Renew European Parliament member and member of the Civil Liberties Committee. "We need a stronger Europol, equipped with the resources and capacities necessary to effectively support national law enforcement forces," she argued. This "must go hand in hand with strong democratic oversight and solid safeguards regarding fundamental rights and data protection".
The EU unveiled this summer a project aiming to operate a "transformative evolution" of the agency based in The Hague. It is planned to double its budget to reach 3 billion euros, and to give it an active role in the fight against new threats, by giving it access to more data and cutting-edge technologies.
While developers and policymakers debate the opportunity to slow down the development of cutting-edge AI models, law enforcement agencies are already confronted with criminals using the latest technologies.
But this project also raises questions regarding governance and privacy protection, sparking a heated debate on the extent of powers that law enforcement should have to ensure citizens' safety in the face of AI and thanks to it.
Wojciech Wiewiórowski, the European Data Protection Supervisor, who ensures that all EU agencies and institutions comply with the rules in this matter, said he was "entirely in favor" of the idea of giving Europol the means to use data and new tools based on artificial intelligence. But he "must have oversight", he added.
"When I hear about strengthening Europol, modifying its scope of action and making truly very important investments in the agency itself, I rejoice as a citizen," he continued. "But I must ask the question: why is there nothing in the proposal on how to supervise Europol?"
Faster and on a large scale
For Jürgen Ebner, Deputy Director General of the agency, who was appointed last month to its head, fighting crime today requires equipping Europol with all the capabilities offered by artificial intelligence.
"AI is transforming the way crimes are committed across a wide range of criminal activities," he explained a week after being appointed by the representatives of the Member States to this position, subject to the opinion of the European Parliament. "AI makes criminal activities faster, more sophisticated and easier to carry out on a large scale. This represents a major challenge for law enforcement."
Europol, which employs more than 1,700 people, was designed as a centralization organization, collaborating with European police services to facilitate the analysis and sharing of potential evidence and other information related to criminal investigations.
As part of the new project, the EU now relies on this agency to develop new ways of using AI to sift through the mountains of available data and help national police forces solve cases in real time.
If the latest advances in artificial intelligence can be useful to criminals as well as to law enforcement, the latter must in addition respect democratic principles. While Europol will be able to process a potentially colossal volume of information, privacy protection could well be the principle most at risk.
This issue is at the heart of Jürgen Ebner's concerns, who is now virtually assured of leading Europol for the next four years. He pointed to the legal controls that weigh on police forces when they attempt to use AI.
For him, rapid access to electronic evidence is essential to make the most of the emerging capabilities of artificial intelligence. "It can help investigators filter large volumes of digital evidence, link information together and identify actionable intelligence," detailed the German. "AI can multiply the capabilities of investigators and analysts, and give them more time to interpret the evidence."
Privacy versus security
Debates on how police collect and process citizens' data often pit security against privacy. However, Jürgen Ebner argued before police officers, at a conference in Lisbon last month, that Europol must not slip into a situation where "data collection becomes an end in itself, technology serves to justify its own use, or urgency serves as a pretext to abandon safeguards".
Also addressing the police forces of all Europe gathered in Lisbon, Wojciech Wiewiórowski, the European Data Protection Supervisor, considered that the EU's proposal "officially lays the foundations for police action in Europe based on artificial intelligence and data".
The EDPS had already flagged Europol regarding its data collection practices and had opposed an earlier proposal aiming to broaden the agency's scope of competence.
He warned that the Europol reform proposal entailed serious privacy risks, and would allow the agency to retain data on a "vast" number of people having no link to criminal activities "for a prolonged and indeterminate period".
The proposal preserves, to be sure, the role of the EDPS in supervising Europol, but Wojciech Wiewiórowski pointed out that it did not provide, alongside Europol's expansion, an equivalent strengthening of the EDPS's powers or resources. He also judged that it gave "too much power to Europol's internal organs, without external oversight".
For Europol's Data Protection Officer, Daniel Drewer, these accelerated measures are necessary in a world marked by "rapid technological evolution that benefits not only police forces or state actors, but also criminal networks".
The Europol reform comes as the EDPS already struggles to cope with its new responsibilities regarding monitoring the use of AI by European institutions.
Furthermore, Stéphane Duguin, a former Europol cybercrime official and now head of Protect.ngo, argues that law enforcement agencies also struggle to keep up with the technological and strategic advances of their adversaries. Beyond the challenges related to their technical capabilities, he estimates that the European police network must also overcome obstacles linked to its structure, set up long ago.
Criminals "do not only commit cybercrimes, interfere in foreign affairs or manipulate information, but that is how police forces operate. And that is the problem", stresses Stéphane Duguin. "If one considers Europol out of its context, it makes no sense, because the entire judicial chain must evolve. If one has increased means to investigate online crimes but, in the end, cases are not brought before courts due to national legislation, then it makes no sense."
This article was first published by POLITICO in English, then edited in French by Jean-Christophe Catalon.
