Why Belgium’s plan for PNR for rail and buses/coaches must be stopped

Put yourselves in the shoes of a terrorist for a moment. You need to transport your home made bomb from Frankfurt (Main) in Germany to Brussels in Belgium. You know the plane is no good for this – they’ll check your bag. Loads of documentation is needed to hire a car so that’s out, you do not have money for a car of your own, and stealing one is too risky. So you will take public transport – a train or bus/coach.

This is the sort of thinking that has motivated the Belgian government to try to step up its security on its transport system, and motivated by the 2015 Thalys attack, the government -spurred on by its populist N-VA interior minister Jan Jambon – does not want to stop at planes, but has trains, coaches and ferries in its sights too. Both Politico and Le Soir have written briefly about the issue, but I want to look at this in more depth.

The idea is to apply the Passenger Name Record (PNR) system that is being implemented for air traffic to surface transport. The Projet de Loi (PDF) and Rapport de la Première Lecture (PDF) of the law from the Belgian Parliament are now available. The idea is that the names of passengers on cross border routes would be cross-checked with a police database, to see if a suspicious person were travelling.

But think of this just for a moment and the whole thing starts to unravel.

First of all, the system is called Passenger Name Records. Do you have a passenger’s name if he/she travels on a cross border train or coach? At the moment that is not always the case, although the name is often required if the ticket is a cheap one bought ahead of time. But to make PNR work you need to make entering the name on a ticket compulsory – that, for a company like Deutsche Bahn – is going to be an enormous administrative undertaking. The firm would have to change every single one of its thousands of ticket machines in Germany for a start.

Second there is the issue of time. It is only any good to know who is on a train or coach long enough ahead of time so the law and order authorities could theoretically step in and stop that vehicle. But you can just rock up at a railway station and buy a ticket on the spot and, were that station – say – Aachen, you reach the border to Belgium just a few minutes after boarding. You could try to impose a system obliging all cross border tickets to be booked, say, 24 hours in advance – to allow law authorities access to the data. There are of course privacy and data security implications to all of this, but that’s a different issue I will not examine here.

However obliging booking ahead of time falls down when you think of the types of cross-border journeys people make into Belgium. A high speed ICE train from Frankfurt (Main) to Brussels, or even a Flixbus or Eurolines coach on the same route could be considered to be similar to a flight – these are trips you are seldom going make on the spur of the moment. But this ignores all the local cross border traffic at Belgium’s borders – things like the local Regional Express train from Aachen to Spa via Welkenradt, or Bus Line 14 from Aachen to Eupen in Belgium. For the bus you just get on and buy the ticket with cash from the driver, and for that local train there is no way to even book ahead.

So with that in mind, the Projet de Loi narrows the definition of the types of transport to which the law will apply:

Note: trains internationaux à grande vitesse – international high speed trains. So this would apply to Thalys and ICEs, but not to the local Regional Express. The line on buses is more complex to understand – cars would usually be translated as coaches, but it is not clear if a bus like the Aachen – Eupen service would fall foul of this.

So back to the terrorist trying to get to Brussels from Germany. S/he will research the way these things work just as thoroughly as s/he probably researched bomb making techniques online. Avoid Thalys and ICE, and long distance coaches, and take the Regional Express. Travel to Aachen, change there onto the Regional Express across the border. Once inside Belgium take any other train to Brussels. Simple as that.

Essentially the issue is this: as you cannot impose PNR on all cross border surface transport, there is no point whatsoever imposing PNR on any of them.

The holes in the net – the way law is drafted currently – are simply too damned huge. And it’s not just Aachen – Welkenraedt where this would be the case, but Luxembourg – Arlon, Lille – Kortrijk, Maastricht – Liège and Rosendaal – Antwerpen too. Impose PNR on all those and you kill vital cross border local rail services because you cannot viably collect all the user data ahead of the passengers making their trips.

This then is why PNR for surface transport in Belgium must be stopped. In its current form its costly to the Belgian state (€13 million to set it up) and costly to rail firms like DB and Thalys to implement (exact costs unknown), and we – taxpayers and rail passengers – would have to pay that. But as my little example above shows it actually makes no contribution to security as finding a way around the system is absurdly simple – just take the regional train instead.

As the Belgian think tank The Egmont Institute puts it (PDF here, p. 23, thanks João):

taking it as a given that it will facilitate the arrest of terrorists who are planning attacks is something of a fairy tale. Indeed it seems to fail to take into account the fact that terrorists as well as ordinary citizens are informed of the existence of this database and they will adapt their behaviour accordingly.

Jan Jambon would do well top listen to that and ditch the whole plan.

[UPDATE 24.11.16, 1945] According to Dutch newspaper De Telegraaf the plans have been put on ice for now! Good. Let’s hope they do not ever advance further!