Pirate Party President Sven Clement on Trial
On Wednesday 24 September 2014, after having listened to two witnesses and giving a statement in a legal case against him, Sven Clement walked out of the courtroom feeling confident and amused. He had just plead guilty to intrusion of a protected database, but not guilty to (aggravated) theft. The combination of these charges could lead up to 10 years in prison and a 25,000 Euro fine. So how did it come to this? The Pirate Times interviewed Sven about what happened and presents his side of the story to you.
Sven Clement is the (co)founder and current president of the Piratepartei in Luxembourg. Being only 25 years old, he is proud to point out that he is currently the longest serving president of a Pirate Party worldwide. Sven has been the president of the party ever since its foundation on 4 October 2009. During his spare time, Sven enjoys playing volleyball, which is what caused him to get caught up in this bizarre lawsuit against him.
In Luxembourg athletes are required, by law, to get a medical exam every 3 years to make sure that they are still fit to play their sport. When Sven realized he couldn’t play a weekend in early January 2012 (unless he got his required exam), he quickly scheduled an appointment with a doctor in order to adhere to the law. At the appointment he was left alone in the doctor’s office with a laptop sitting unattended on the desk in front of him. On the laptop was a sticky note with some characters written on it, they seemed to be a username and password combination. Sven became concerned about the implications and decided to photograph the sticky note for evidence. More than 2.5 years later, a prosecutor would argue in front of a judge that taking this photograph should be regarded as being the equivalent of theft.
Medical data that comes from the required exams is stored in a database of the governmental ‘service médico-sportif‘ (sports medical service). Although this database was never legally registered, it is being managed by the Luxembourg government, of which one might expect a high standard in regard to security and privacy. Two days after the doctor visit, Sven remembered the incident and decided to attempt to log in to see whether his suspicions were correct. Sven was worried that he had stumbled upon the physician’s login credentials for the database. To his surprise and shock, he found that he had access to over 48,000 medical files on licensed athletes in Luxembourg (dating back to 2005). All medical data, such as injuries and surgeries are noted in the files, as well as personal details (including addresses and information on the parents).
Being a Pirate, Sven knew that this indicated an unacceptable negligence in protecting medical and other personal data. Thus he contacted the Computer Incident Response Center Luxembourg (CIRCL). Which is the ‘government-driven initiative designed to gather, review, report and respond to computer security threats and incidents’. Following their advice, he took screenshots of his own personal data within the database as evidence, disconnected from it and never reconnected again. After a week of no adequate actions being taken, he decided to bring this breach of confidentiality to the attention of the public by contacting the press on his birthday, 19 January 2012.
Throughout January, the Luxembourg press reported the incident. It was suggested that a member of the Piratepartei was involved, which was neither denied nor confirmed by Piratepartei.
“Had police contacted the party, we would have been willing to cooperate, ofcourse. They never contacted the party or myself, though.” – Sven Clement
By the end of that month the news reports about ‘medicoleak’ (as it had been called) died down, only to flare up again in April when police raided the home of Sven Clement. Additionally, the home of an employee of CIRCL, Steve Clement (who happens to have the same last name as Sven) was also searched. Laptops, iPhones and other hardware was confiscated for investigation by the police. Sven fully cooperated and before being taken down to the police station for questioning he requested to be allowed to take a shower.
“I told them that they could join me in the shower if they were concerned that I would run away.” – Sven Clement
He was amused to find that police took this comment seriously enough to post an officer next to him as he took a shower.
The Chaos Computer Club of Luxembourg and the Déi Gréng (Green Party of Luxembourg) openly showed support by criticizing the legal proceedings against Sven and Steve. The Piratepartei Vice-President, Jerry Weyer, gave a statement in which he expressed the party’s full support and criticized the government’s lack of adequate measures to prevent such a leak in the future. Although the incident had been dubbed #medicoleak in the media, no data has been leaked to this day. Sven and CIRCL merely looked to bring this problem to the attention of the government. Firstly when the government failed to respond and take action was when Sven took it to the press, in order to inform the public.
Meanwhile the Sports Minister Romain Schneider and the Minister of Justice François Biltgen claimed that Sven had ‘stolen’ the password and that by taking screenshots of a database that was owned by the government he had infringed on its copyright. Of course this charge did not hold up in court when the decision was made that Sven would be prosecuted. Although the ‘chambre de conseille’, a panel of three judges who advice the prosecutor whether or not to move forward with the case, concluded that prosecuting for aggravated theft would be a stretch, they did permit the case to go to trial.
The implications of this case may be more grave than one would think on first glance. Considering that copyright infringement is civil law in Luxembourg and theft is penal law, Sven could face some serious consequences for trying to bring this negligence to the light.
“If a judge rules that taking a photograph is the equivalent of theft, then that would change all the copyright laws in Luxembourg. These old white men in suits don’t understand that taking a photograph or other type of copy is not stealing.” – Sven Clement
The Piratepartei has published a statement in support of Sven, saying that:
“We can only be amazed at the incredibly large definition of ‘stealing’ that the prosecution wants to construct in this case. Taking a photo of a password on a post-it is definitely not the same as stealing that post-it. The former government didn’t understand how to responsibly set-up databases and instead of acknowledging their negligence, they are punishing the person who tried to make the public aware of this deficit.”
An independent journalist, who believes the trial is “kafkaesk”, started a crowdfunding website to raise funds for his defense and possible fine. Sven has already paid more than 5.000 Euros in legal bills and the trial is not over yet. To support Sven in his case against the Luxembourg government, please visit medicoleak.lu to make a donation.
Since the interview, Sven Clement was re-elected as the President of Piratepartei during the general assembly of the party (that took place one day after the party’s anniversary on 5 October 2014). Sven was voted in as President with a staggering 93,3% of the votes.
Featured image by Eiren McLoughlin, CC BY-SA 2.0