Ruling: BND data vacuum cleaner partly unconstitutional for cyber threats

Legislators must once again take a detention period with regard to the powers of the Federal Intelligence Service (BND) and further restrict them. This was determined by the Federal Constitutional Court in a ruling published on Thursday, October 8, with regard to the controversial mass surveillance by the foreign intelligence service in the form of strategic domestic-foreign telecommunications reconnaissance (Ref.: 1 BvR 1743/16, 1 BvR 2539/16). The authorization for the use of the data vacuum cleaner used for this purpose is therefore partly incompatible with the secrecy of telecommunications in the area of cyber threats.

In principle, the instrument is compatible with Article 10 of the Basic Law despite its particularly high level of interference, the First Senate ruled. Strategic telecommunications surveillance is of "overriding public interest". However, the legal structure of the tool is disproportionate: there is currently no adequate provision for the separation of data from purely domestic telecommunications traffic, with the BND relying on email addresses ending in .de, for example. The Article 10 Act does not contain any provisions on how to deal with the data "necessarily collected from purely domestic telecommunications traffic, at least on the internet".

The protection of the core area of private life for foreign persons abroad is also inadequate, the judges in Karlsruhe emphasized. The targeted recording of internal processes, thoughts and experiences of a highly personal nature is also inadmissible in relation to foreign persons abroad. Search terms relating to this intimate sphere may not be used here.

Yield for cyber threats was mostly meagre

The retention period for the documentation was also too short, the Constitutional Court criticized. The design of the independent monitoring by the G10 Commission is also inadequate. This oversight must, for example, compensate for the de facto weakness of individual legal protection options resulting from the limited information and notification obligations regarding strategic telecommunications surveillance. As a substitute, a "technically competent, professionalized court-like control must be ensured". It is not sufficient that the members of the G10 Commission "merely hold an honorary public office".

The judges in Karlsruhe have given the legislator until the end of 2026 to amend the standard in the law restricting telecommunications secrecy. Until then, it will continue to apply with modifications. In recent years, the BND has often not been able to gain any major insights from the use of the data vacuum cleaner anyway. In the cyber threat area in particular, the yield from scanning international telecommunications with search terms was meagre in 2019. With the approval of the G10 Commission, 130 selectors were ordered in this sector in the first half of the year. However, the department evaluating the data did not classify any of the telecommunications traffic caught in the sieve as relevant to intelligence services.

Constant puzzle work by civil rights activists

In May 2020, the Federal Constitutional Court had already ruled that the strategic telecommunications reconnaissance practiced by the BND violated the Basic Law. A short time later, the Bundestag legalized this form of mass surveillance again in principle, even though some of the requirements for the groups of people that can be recorded have been increased since then and monitoring was to be improved. At the same time, the legislator significantly expanded the danger areas in which the BND is allowed to start up the data vacuum cleaner.

"The latest ruling from Karlsruhe proves that our strategic lawsuits for better protection of privacy are having an effect," says Bijan Moini from the Gesellschaft für Freiheitsrechte (GFF), who is pleased with the new announcement. "Bit by bit, the decisions we have won from the Federal Constitutional Court are bringing intelligence service work back onto the ground of the Basic Law." The GFF had already filed a lawsuit in 2016 together with Amnesty International.

(dmk)