Romania's intelligence service is about to build a system to identify people taking part in street protests or talking on Facebook or Skype, according to four local human-rights groups.
In an open letter published on Monday, the groups said the system would be capable of running facial recognition on three million people. It could also intercept online traffic without the consent of the users and will have unrestricted access to all public databases containing information about citizens.
The system, dubbed SII Analytics, "uses European funds to impinge on European rights", they said, describing the endeavour as a "Big Brother project".
However, a Romanian intelligence-service spokesman told ZDNet in an email: "The system does not collect new data. It only analyzes existing data, based on algorithms."
The intelligence service also said that SII Analytics is necessary to handle threats such as "terrorism, illegal migration, organized crime, all of which require a quick reaction" from the agency.
"The platform aims to considerably enhance the speed of searching information in already existent databases."
The local human-rights groups said the official purpose of the project, as listed in its description, is reducing waste in public payments, cutting fraud, preventing abuse, and providing more efficient governance.
They argue that European funds for the project were accessed to develop e-governance, which has nothing to do with facial recognition or tapping internet traffic. Also, the intelligence service has no competences in e-governance, the NGOs wrote.
They also said the platform's access to facial information on three million people would most likely be based on their ID and passport pictures, to which the intelligence agency already has access.
The project would allow intelligence operatives to find 100 people within 15 seconds, using face-recognition technology. It would also let them perform searches in the field on mobile devices.
The local human-rights groups described a scenario where an agent or a policeman would take pictures during a protest, and all those individuals would be identified immediately and fined.
They also fear that the system could eventually automatically aggregate pictures posted on Facebook and link them with those already in the state's databases.
The specs of the project also include four traffic access point (TAP) devices. They could, in theory, be used to record metadata, according to signatory the Association for Technology and Internet.
Another issue the human-rights groups draw attention to is related to database aggregation. They say agents could perform complex information searches across multiple platforms, such as those of the police, national health insurance organisation CNAS, or the ANAF revenue service. They would be able to find links between people, their income, the cars they own, and their phones.
That type of database aggregation is illegal, they said, bringing as an example the case Bara vs CNAS and ANAF. The European Court of Justice ruled that "a public entity cannot offer the data it collects to another public entity, on the basis that it might prove useful at some point".
The human-rights groups also fear that the system would not only be used to prevent terrorism, but that without oversight agents could use it for their own personal agendas.
However, the Romanian intelligence service said there will be a complex audit to make sure the project follows security regulations on stored data. "Every query will be automatically logged and analyzed to avoid abuses," the agency said in a statement.
They also said SII Analytics is "a modern platform, similar to those found in other European countries".
Tech companies who would like to build this project are invited to tender their bids by August 22. Costs are estimated at about €31.5m ($35m), the largest proportion of which will be covered by European funds. The system should be operational by mid-2018.
In their letter, the four human-rights groups ask for clarifications and for the project to be brought to a halt. They want transparency and guarantees that abuses will be prevented.
The groups have notified the European Commission, arguing that EU funds would be used for purposes other than those for which they were specified. The open letter was also sent to several government institutions in Romania.
The document was signed by ActiveWatch, the APADOR CH association for human rights in Romania, the ApTI association for technology and the internet, and Romania's legal resource center.