A bill that would replace the current law on the intelligence and security services is open for public consultation. It is called the Wet bescherming nationale veiligheid. Under it, the work of the TIB, the committee that checks in advance whether far-reaching powers are being used lawfully, and that of the CTIVD, the body that supervises the AIVD and the MIVD, are merged into a single College van Toetsing en Toezicht (bijzonderstrafrecht.nl).
Minister Yesilgoz says that oversight under the new law will be "robust". The same reporting notes that the law gives the services a great deal more room (security.nl). Both can be true. The combination is not a comfortable one.
What is being added is not a detail. The first phases of a hacking operation may be carried out without prior oversight, and the services can compel individuals and organisations to hand over data (security.nl).
The timing of oversight shifts as well. Instead of a binding check by the TIB before a power is used, scrutiny comes while it is in use and afterwards, from the CTIVD (security.nl). Checking after the event is by definition too late to prevent anything. On top of that, the CTIVD has no binding powers, so it cannot step in at the moment when stepping in would count (Bits of Freedom).
The scale is the other problem. The services have the power to collect data on millions of people in enormous quantities, after which everything that turns out not to be relevant has to be destroyed as quickly as possible (Radar). "Since the 2017 law we have seen a trend of the services collecting data on an ever larger scale while oversight shrinks," says Lotte Houwing of Bits of Freedom (NOS).
Why steps like these are rarely reversed
Look first at what has already happened to the people who do the checking. Bert Hubert, the technical member of the TIB, resigned on 9 September 2022, after less than two years, out of dissatisfaction with the proposed Tijdelijke wet cyberoperaties (Wikipedia). "But as a person I have trouble with the expansion," he said. In his view, advice from the Raad van State shows that the widening of the powers and the shift in oversight will not be undone (security.nl). The chair of the TIB left as well. In her resignation letter, Moussault pointed to the temporary law that lets the AIVD and the MIVD deploy special powers more quickly (security.nl).
Once a power has been written into law, it tends to stay there. And data that has been collected cannot be recalled. Whatever is handed over now will not come back of its own accord when the next government takes office.
And if you have nothing to hide?
That is the most familiar reply in any debate about surveillance. If it really were the standard, the government might as well put a camera in everyone's living room and listen in on all phone calls as a matter of course. Almost nobody finds that acceptable, so apparently even people with nothing to conceal care about privacy. The discussion has long since stopped being about whether there is a line, and is only about where it runs.
To be fair: not every change amounts to demolition. When the current law was being drafted, the comments from the consultation did in fact lead to changes in the draft text and the draft explanatory memorandum (Kamerstuk 35242). That powers are needed to track digital threats goes without saying. Anyone who calls every adjustment an erosion of the rule of law can no longer tell a technical repair from a real expansion, and loses the argument before it starts.
Except that here the distinction is easy enough to make. TIB chair Anne Mieke Zwaneveld stated the test in a single sentence: "If the powers grow, then the protections and the oversight must be strengthened too" (nieuws.nl). More room for the services while binding prior review disappears is movement in the opposite direction.
Watchdogs come and go. Government powers have a habit of only moving in one direction.