Monitoring: A total invoice with open items

Contents

It was an attempt to clear the jungle: How much state surveillance is already taking place these days? Scientists were commissioned by the German government to find out how this can be researched. Like many expeditions, it was only a partial success. The "overall surveillance report" was quietly published on Friday.

The working basis was clear: the state must not know everything and it must not be in a position to know everything at all times. This is because citizens would otherwise forfeit their freedom of action – as they would orient their behavior towards behaving preventively not only in accordance with the law, but also opportunely. Time and again, powers such as data retention, source telecommunication surveillance, license plate matching or grand eavesdropping, which appear to be helpful for intelligence or police activities, end up before the constitutional courts of the Republic.

The Federal Constitutional Court has pointed this out many times: Individual citizens, even as suspects of a serious crime, must not be subject to seamless "all-round surveillance", nor must the powers subject society as a whole to even approximate total surveillance. At the same time, the intensity of the powers changes as the use of technology changes: unencrypted text messages, for example, are now an exception –, while comprehensive IP data retention only affected part of the population when it was first discussed, but now affects almost everyone.

How do you measure surveillance?

The Max Planck Institute for the Study of Crime, Security and Law was therefore commissioned by the Federal Ministry of Justice and the Federal Ministry of the Interior to investigate how to calculate how much surveillance is already being carried out by government agencies. The aim was to provide politicians and the public with "a tool with which the contributions of the individual measures to the overall picture of the 'surveillance landscape' can be assessed and compared in a balanced way", according to the study itself. But how do you measure surveillance as accurately as possible?

Firstly, the traffic light task was to record the legal bases with which investigative authorities and intelligence services carry out surveillance measures. The authors found 3228 powers and variations thereof. What authorities are allowed to do differs from state to state, as police law and that of the respective constitutional protection offices is state law. In addition, there is federal law, which also includes the law of the Federal Intelligence Service.

Using formulas to calculate intensity

For the overall surveillance calculation, all of these powers were listed, analyzed and evaluated according to categories: Are they targeted or do they include other people? How secretive are they? A total of nine such "intensity criteria" were evaluated. But also: to what extent are the measures restricted? How high are the hurdles before they can be used? Do they have to be notified afterwards, does a measure have to be recorded? Is there independent monitoring? These are all factors that the authors of the study wanted to use to get closer to reality. Using calculation formulas, a value was created for each of the legally possible measures for each federal state and the federal authorities.

The result, which was sent to the clients in January and communicated to the ministries in the same month, was correspondingly comprehensive. While Federal Minister of Justice Volker Wissing would have liked to publish the results before the general election, the Federal Ministry of the Interior was in no hurry to do so. Without any comment from the Ministry of Justice or the Ministry of the Interior, the results were quietly published online on Friday morning. Despite the problems, the attempt at an overall surveillance report does provide some insights.

Bavaria: many powers, high standards

For example, the number of measures that would have to be considered relevant for an overall surveillance calculation is particularly high in Bavaria and Rhineland-Palatinate compared to the other federal states, and particularly low in Berlin. However, the authors believe that this says nothing about the actual quality of the intervention. This is because in Bavaria, for example, they are regularly provided with high regulatory standards – which, in their view, reduces the intensity again.

However, the most important finding is probably a failure for the actual objective. This is because the study should not only include the legal possibilities, but also the actual measures that were implemented. In other words, not just the legal theory, but the actual surveillance practice. The intelligence services did not provide any information on this at all, citing secrecy. And for the other figures, too, the authors had to rely largely on what was publicly available anyway. This is because many authorities that have surveillance powers are not in a position to provide more precise information on their use. This is because this is regularly not recorded in a structured way in everyday life.

The police often don't know exactly

In many countries, it is almost impossible to determine how long a radio cell search actually lasted after the initial request. According to the authors, it was also difficult to record the reason for a measure: "For example, the case processing systems of the police forces do not provide as standard for the authorization basis referred to to be entered in the cases," the study states as an example. Saarland is an exception here, where the basis on which a measure is to be carried out must be specified when the police submit an application since 2021. The authors were also concerned that many systems are used in parallel in many federal states – digital specialist procedures for individual measures, procedural paper files and reports often exist in parallel. And so the under-digitization of the everyday lives of law enforcement officers takes its toll even when trying to find out how much surveillance actually exists.

424 million passenger data

However, the authors were able to find some indications of the extent to which the powers are actually being used. The authors of the study consider the most frequent case of state intervention to be the passenger data that goes to the Federal Criminal Police Office: More than 424 million pieces of data were transmitted to the Wiesbaden-based federal authority by airlines in 2022 – an almost seamless record of all air travelers, which is being kept on file. Overall, this measure, which was agreed under European law, is a "surveillance driver", according to the authors. On the other hand, targeted searches of passengers by the authorized authorities are much rarer.

According to the authors, the most frequent measures include, among other things, inventory data information: Who does an IP address belong to? The BKA reported 86,428 queries for this, which is due to a high degree of automation. Here, the authors show that their approach for an overall surveillance calculation still has plenty of room for improvement: "Since a (dynamic) IP address can only be assigned to one connection at a given time, a hit in this case also means that only one data record is transmitted," the study states. The authors seem as unaware of the fact that there are often several connections behind one IP address due to widespread techniques for saving IP addresses (NAT) by Internet providers as they are of the fact that a large number of other users can be affected behind one public IP. Such technical subtleties detract from the otherwise perfectly understandable thoughts of the Max Planck researchers on issues such as the intensity of intrusions in some places.

Hamburg is the capital of telecommunications surveillance

Despite such problems, the authors were also able to make some statements about intensity based on the available data: The authorities in Bavaria, for example, use the interception of telecommunications traffic data particularly frequently, while in Thuringia this takes place the least frequently. In the most populous federal state of North Rhine-Westphalia, on the other hand, telecommunications surveillance is comparatively rare, while it is most frequent in the small city of Hamburg. The authors did not answer whether this is due to the respective legal bases or other reasons in their study.

"No data" does not mean "no problem"

But is Germany now on the verge of becoming a monitored society - or even beyond? The study now published by the Max Planck researchers simply cannot answer this question. Both the data and the willingness to cooperate are lacking. Above all, the scientists are therefore concerned that without effective documentation of the measures, it is difficult to conduct an objective assessment – and this is also an increasing requirement of the constitutional court. The authors suggest improvements here. The fact that this would probably require improvements in the digitalization of the police authorities' working methods does not necessarily improve in the situation any more likely in the near future. The authors also write that they were unable to identify "any branches of government or federal states with a decided affinity for surveillance". However, there were clear differences in the regional distribution.

What the authors have therefore achieved with their study on behalf of the federal ministries: A structured, albeit still improvable, approach to how an overall view of state surveillance measures and their respective quality can be approximated. However, drawing conclusions from this would now be a matter for politicians - both at federal and state level. It is not yet known whether the future Federal Interior Minister Alexander Dobrindt (CSU) intends to pursue the project further. In any case, the coalition agreement between the CDU, CSU and SPD does not contain any such intention – The last coalition of these parties had strictly rejected the project.

(nen)