Surveillance: Law enforcement agencies are once again using more state trojans

The police have continued to expand their telecommunications surveillance and the collection of traffic and usage data in terms of numbers – in some cases significantly. For example, secret intrusions into IT systems by investigators continue to boom. In 2023, courts granted law enforcement agencies and other law enforcement authorities in Germany 116 authorizations to infiltrate smartphones and computers using state trojans, for example, and to intercept data.

This is according to the new statistics on telecommunications surveillance under Sections 100a and b of the German Code of Criminal Procedure (StPO) published by the Federal Office of Justice (BfJ) on Tuesday. In 2022, 109 relevant orders were issued, in 2021 "only" 55. The number of corresponding surveillance authorizations has thus more than doubled within two years.

The new statistics for 2023 on Section 100a StPO now show a total of 104 orders for source telecommunications surveillance (TKÜ) from – compared to 94 in the previous year. This measure involves intercepting communications directly on a terminal device before encryption or after decryption.

Exploring hard disks

62 times an intrusion into an IT system was actually carried out using source interception, which is 13 more intrusions than in 2022. Investigators therefore appear to have gained more practice and experience in using the corresponding interception tools. The authorities in North Rhine-Westphalia (NRW) alone are responsible for 35 measures, those in Lower Saxony for 18, Saxony for eleven, and Bavaria and Berlin for eight each. The Federal Public Prosecutor General used state Trojans four times (three times in 2022). Once again, the authorities cited drug offenses as the main reason in all TKÜ areas: As in previous years, suspicion of an offense under the Narcotics Act was the main reason for the search.

According to the overview of Section 100b of the German Code of Criminal Procedure, the number of proceedings in which judges ordered secret online searches also increased slightly again, from six in the previous year to eight. This allows investigators to use Trojans to inspect hard drives, for example, and not just record ongoing communication. The number of initial and renewal orders in this area in 2023 was 26, of which a total of six were actually carried out. In 2022, there were 15 authorizations, seven of which could be implemented. The Federal Public Prosecutor General was responsible for 19 orders in 2023 and Bavaria for 3. The majority of cases (20) concerned the formation of criminal or terrorist organizations.

The overall figures for measures to monitor telecommunications in accordance with Section 100a of the Code of Criminal Procedure, which also includes the interception of telephone calls without spyware, remained relatively constant. In 2022, the courts approved 15,939 orders in 4970 proceedings. This is an increase of 3.2 percent compared to 2022.

Usage data including passwords in high demand

The retrieval of usage data including passwords, usually stored as hash values, from telemedia services such as Facebook, WhatsApp, Google or X in accordance with Section 100k of the German Code of Criminal Procedure (StPO) has not been permitted for long. In 2023, a total of 246 orders were issued nationwide in 207 proceedings under Section 100k (1) of the Code of Criminal Procedure. This represents a massive increase of 135.2 percent compared to the previous year. According to Section 100k (2) of the Code of Criminal Procedure, which ranges from endangering the state to computer fraud, a total of nine orders were issued in eight proceedings in 2023 (2022: six proceedings with seven orders).

The BfJ has also published statistics on the retrieval of connection and location data in accordance with Section 100g StPO. According to these statistics, a total of 34,473 measures were ordered in 22,617 proceedings nationwide in 2023. This corresponds to an increase of 10 or 14.2 percent compared to 2022.

(vbr)