The Ministry of Defense is promoting legislation that would allow the IDF and the Shin Bet to penetrate and make changes to the computers used to operate stationary cameras. It is making the argument that this authority is needed in order to prevent the leakage of visual information that could endanger the security of the state and the operational activity of the IDF.
On October 14, the government approved emergency regulations that authorize the IDF to penetrate and operate on computer material used to operate stationary cameras. Three days later, emergency regulations were approved giving similar authority to the Shin Bet. On October 20, the National Cyber Directorate issued an urgent warning, according to which hostile elements are attacking cameras connected to the network. The Directorate then warned that these cameras, especially if they are watching public areas or sensitive facilities, could be used by the enemy to gather intelligence.
Now, the Ministry of Defense is seeking to give more permanent validation to the authority that the IDF and the Shin Bet received in 2018 and published a memorandum of law to grant this authority as part of a temporary order for at least six months. According to the memorandum, which was published tonight for public comment, a qualified officer will be able to authorize an IDF soldier to hack into a computer that is used to operate a stationary camera and perform actions such as deleting, changing, or disrupting the visual information collected by the camera if it believes this information could endanger the security of the state or the operational activity of the army, and the action is required in an “immediate and urgent” manner. The law allows this operation to be carried out even without the knowledge of the owner of the computer material and without the need to obtain a court order. A similar authority is granted to the Shin Bet, which can also receive information from communication between computers without it being considered wiretapping.
The supervision of how this authority is exercised is relatively limited. The IDF and the Shin Bet are required to inform each other, as well as the Cyber Directorate, of any action within the framework of the law, and the Chief of Staff and the head of the Shin Bet are required to report once a month to the Defense and Security Committee and the Attorney General on the number of soldiers or service employees who are authorized to carry out infiltration operations and the number of computers that have been operated on as well as the types of activity. These reports, however, will be confidential. The protection of privacy within the law is also limited, and is summarized in the statement that “the IDF and Shin Bet will not use or keep information, including information about a person’s private affairs.”
The legal memorandum does not provide for external control mechanisms, for example in the form of court supervision, even in retrospect, or involvement of the Authority for the Protection of Privacy in the Ministry of Justice in the process of exercising authority.
According to the memorandum, the law will be in effect for six months, when the Minister of Defense, with the consent of the Prime Minister and the approval of the Foreign Affairs and Defense Committee, may extend it for up to six additional months.
