Faeser-Buschmann plan: Using state trojans against ATM hackers

Federal Minister of the Interior Nancy Faeser (SPD) and her colleague in the justice department, Marco Buschmann (FDP), presented a draft bill to amend the Explosives Act on Saturday in the middle of the parliamentary summer break. One of the key points of the initiative is that the police should be allowed to hunt down ATM blasters using state Trojans. According to the plan, law enforcement officers will also be allowed to read encrypted messages exchanged via messengers such as WhatsApp, Signal or Threema for this purpose. In addition, the two heads of department want to criminalize attempts to illegally purchase or offer explosive substances.

According to the draft, ATM explosions should be punishable with prison sentences of at least two years, and under certain circumstances even from at least five to 15 years. The duo also want to tighten the penalties for gang and commercial offenses in the Explosives Act. Such activities could then be punished with a prison sentence of six months to five years. At the same time, such offenses are to be included in the already broad catalog in Section 100a of the German Code of Criminal Procedure (StPO). This originally regulated the interception of traditional telephone calls or access to emails. Since 2017, however, it has also allowed investigators to spy on encrypted internet calls and chats in numerous cases.

At the time, the legislator created a legal basis for source telecommunication surveillance (source tapping). This involves intercepting ongoing communication directly on a suspect's end device before it has been encrypted or after it has been decrypted. Constitutional complaints are pending against the law on the use of state Trojans for everyday criminal prosecution. On the other hand, Buschmann wants to restrict the power to secretly intervene in IT systems. According to a draft bill from his office, everyday crime should not be affected by this.

Focus on acquiring explosives via social media and the darknet

The two government representatives consider the expansion of the catalog to be necessary, as in practice "the investigation of gang and commercial explosives crime is in many cases futile or considerably more difficult without the criminal procedural instrument of telecommunications surveillance". According to criminalistic experience, in this area "telecommunications are predominantly used to initiate and carry out criminal trafficking in explosive substances" – sometimes conspiratorially. It is therefore regularly only possible to clarify such circumstances with the help of covert measures. This is the only way to trace "the communication channels of those involved".

With an expanded Section 40 of the Explosives Act, Faeser and Buschmann aim to make even the attempted unauthorized acquisition of explosive substances, the planned illegal handling of these substances, "the attempted unauthorized import, transit or transfer as well as the unauthorized transfer of these substances to unauthorized persons" punishable. According to the explanatory memorandum, this applies, for example, to cases "in which the investigating authorities receive information about persons who inquire on social media or the darknet" about the possibility of "acquiring pyrotechnics and other explosive substances" with the intention of using them to blow up ATMs.

The clause is intended to allow police officers to pose as sellers to offenders. Faeser and Buschmann argue that the use of such methods is of great practical relevance in internet investigations. They point out that nationwide, the number of ATM break-ins rose by 26.5 percent from 2021 to 2022 alone, reaching a new high since surveys began in 2005. Despite the security measures agreed with the banking industry, which led to a slight decrease in 2023, the figures remained at a high level. These highly dangerous acts are committed "without regard for the health and lives of uninvolved third parties and emergency services" and cause damage in the hundreds of millions every year. The draft will now go into consultation with stakeholders and other departments.

(vza)