Instead of data retention: Buschmann takes initiative with Quick Freeze

Contents

After years of delays in implementing the quick freeze approach to freezing connection and location data for criminal prosecution, Federal Minister of Justice Marco Buschmann (FDP) wants to get down to business. To this end, he has submitted a new draft bill for the "Introduction of a security order for traffic data in the Code of Criminal Procedure" (StPO) for coordination with the other federal government departments. The Liberal Democrats made their first attempt at this back in autumn 2022, which was "selectively adapted" following the fundamental agreement on this principle within the executive branch in April, according to the Federal Ministry of Justice (BMJ).

The draft, which was published by Netzpolitik.org, is to include a new paragraph in Section 100g of the German Code of Criminal Procedure. According to this, traffic data may be secured on an ad hoc basis for the prosecution of "significant criminal offenses", insofar as it may be of importance for investigating the facts of the case or determining the whereabouts of an accused person. In principle, the measure should only be permitted on the order of a judge.

This will limit the amount of data to be stored to what is necessary, writes the BMJ. This is because only traffic data that is already available to telecommunications service providers for operational purposes and will be collected in the future may be frozen. Messenger services should not be obliged to secure connection and location data.

Broad list of offenses

According to the paper, Quick Freeze will take effect if certain facts give rise to the suspicion that someone as a perpetrator or participant has committed "a criminal offense of considerable significance, even in individual cases", in particular one specified in section 100a paragraph 2. This comparatively broad catalog, which also permits the interception of telecommunications, begins with murder and manslaughter, robbery or extortion. However, it also includes gang theft, certain forms of money laundering, computer fraud, tax evasion, drug crime, child sexual abuse and the distribution, acquisition and possession of relevant images. The wording also allows for the victim's data to be secured.

The collection of stored location data should be subject to stricter requirements: Here, the offense would have to be "also serious in the individual case" and the "investigation of the facts of the case or the determination of the whereabouts of the accused by other means would have to be significantly more difficult or futile". Otherwise, only future location data may be collected, but in real time. Traffic data may also be frozen if "certain facts give rise to the suspicion that someone has committed a criminal offense by telecommunications as a perpetrator or participant" and there are no other investigative approaches.

Under similar conditions, it should also be possible to collect usage data relating to the content of a communication. The BMJ does not consider additional regulations for a login trap, i.e. the collection of a current IP address the next time a telemedia service is used to identify the user, to be necessary. The collection of IP addresses from telemedia platforms is already enshrined in Section 100k of the German Code of Criminal Procedure.

Storage period of up to three months

According to the plan, the frozen data will be available to law enforcement authorities for a limited period of time for subsequent collection and analysis, which will require a new court order ("thawing"). Investigators will initially have one month to do this. This period can be extended twice by a maximum of one month each time. The Telecommunications Act (TKG) is to include transmission powers and specifications for technical and organizational protective measures in line with the state of the art. There are still gaps in the draft regarding the costs for businesses and authorities.

The BMJ explains that a new version of the general and indiscriminate retention of all traffic data is already legally impossible due to the requirements of the supreme court. Alternatively, after many years of controversy over the indiscriminate logging of user traces, law enforcement agencies are offered "an instrument that protects fundamental rights and is also effective". Nevertheless, the paragraphs on data retention, which are still included in the Code of Criminal Procedure, would not be removed from the law at the SPD's request. However, this is "dead law".

Debate on IP address retention without suspicion

Federal Minister of the Interior Nancy Faeser (SPD) continues to push for at least IP addresses to be retained, despite the government agreement and the coalition agreement in line with it. The SPD parliamentary group wants to examine such a step "with an open mind". Buschmann points out: Considering the current case law of the European Court of Justice, a member state wishing to impose such an obligation on electronic communications service providers must ensure that no precise conclusions can be drawn about the private lives of those affected.

The BMJ argues that a corresponding legal regulation should also be limited "to what is absolutely necessary" in terms of duration. Those affected must have effective guarantees to protect them from the risk of abuse. According to the police crime statistics for 2023, the law enforcement authorities succeeded in solving 87.2% of known cases of "the distribution of child pornography content".

(vbr)