Study: Intelligence service data purchases violate constitutional standards

More and more secret services are asking themselves why they should have to go to the trouble of obtaining in a information through costly way human operations or telecommunications reconnaissance when the commercially available big data market is constantly growing. In some cases, they receive highly sensitive data such as home addresses, health information, political beliefs, interest profiles or religious affiliation free of charge with credit card payments. However, according to the Stiftung Neue Verantwortung (SNV), some forms of data purchase represent a considerable encroachment on fundamental rights. Measured against the necessary constitutional requirements, the status quo of the legal framework and control is inadequate.

Data collection originally for the advertising industry

Popular smartphone applications such as 9gag, Kik and caller ID programs are part of a global surveillance system, researchers have discovered. Mobile mass surveillance begins with targeted ads in apps that are sold via real-time bidding (RTB) for real-time auctions of personalized banners. The files, which are initially condensed into profiles for commercial purposes, then end up in the hands of law enforcement agencies and intelligence services, as the Patternz case recently showed. This is a tool of the Israeli state-industrial security complex that analyzes extensive RTB data from providers such as Google and X and creates profiles of five billion devices and their users.

According to the SNV analysis, data brokers sometimes offer information that they sell exclusively to intelligence agencies as customers. Other brokers sold unspecific, relevant products that were also of interest to intelligence services. For example, anyone who needs information about participants in a demonstration can identify internet-enabled devices that were in the area at the time of the gathering using purchased location data. Anyone wishing to track mobile devices in border areas could do so based on movement data purchased on the market.

Government hints at acquisition of advertising databases

The authors Corbinian Ruckerbauer and Thorsten Wetzling write that there is no concrete, public evidence that German espionage authorities such as the Federal Intelligence Service (BND) or the Federal Office for the Protection of the Constitution (BfV) have obtained reconnaissance information as "ADINT" (Advertising Intelligence) from hidden or openly operating players in the data market. "But there are good reasons to assume that this has been happening for a long time." Otherwise, the German government would probably not have referred to the purchase of "extensive advertising databases" and other registers in the explanatory memorandum to its current draft bill to amend the BND Act.

In contrast to other methods of intelligence gathering, however, the comparatively new practice is not subject to any approval procedure, the authors complain. In addition, the processing of purchased data is not sufficiently monitored afterward. By participating in the market for "spying advertising", the agents obtained information "the collection of which would have never been permitted by other intelligence means or would at least have required extensive approval procedures".

The researchers therefore recommend that the German government should "urgently introduce better regulation and more comprehensive controls" on the purchase of advertising databases as part of its planned major reform of intelligence law. For example, the associated encroachments on fundamental rights should be systematized and safeguarding mechanisms introduced, especially in the event of foreseeable serious effects on civil rights. Minimum requirements should be established for the purchase of data with less relevance to fundamental rights. Furthermore, the exchange between German supervisory authorities and colleagues from other countries should be intensified.

(vbr)