AI face recognition and co.: Worst surveillance amendment of all time looms

Contents

The draft law recently presented by the German government to "improve the fight against terrorism" pursues ambitious goals, as it is intended to create nothing other than "modern and appropriate police powers" in an increasingly digital world.

At first glance, it seems as if the police authorities have not had any digital investigative powers to date and are now finally being put in a position to carry out modern police work in the 21st century through urgently needed legal changes. However, when viewed soberly, this is merely a further increase in digital spying and surveillance powers, which builds on a sediment of legal possibilities for digital police work that has existed since September 11, 2001 and even longer.

Ein Kommentar von Dennis-Kenji Kipker

Dennis-Kenji Kipker ist wissenschaftlicher Direktor des cyberintelligence.institute in Frankfurt am Main und Professor für IT-Sicherheitsrecht.

Worst surveillance amendment of all time

But the latest government proposal (PDF) is different: it is not just about creating the umpteenth security authority database, pondering whether it would be better to use data retention instead of quick freeze or whether the hurdles for using the state Trojan are too high. Instead, we are talking about the introduction of the worst surveillance amendment in terms of civil rights that we have ever debated in Germany.

The draft bill is long and the powers are described in complicated terms, so let's just say this much: what the German government has in mind is the creation of a comprehensive authorization for the biometric comparison of publicly accessible data from the internet using automated technical processes such as AI-based systems. The draft law is silent on how exactly this is to work in detail – What is clear, however, is that this is the first time that a single surveillance law has combined data collection, mass data analysis, database merging and artificial intelligence – literally the security authority's data superhit.

Data retention? A walk in the park!

While the census ruling and the European Charter of Fundamental Rights state that the collection of personal data requires justification and must be limited to the specific individual case, the proposed legislation turns this principle into the exact opposite.

In principle, all citizens whose faces and voice data are available on the internet are first and foremost subject to the security authorities' bycatch –, which is then compared and sorted out on an ad hoc basis. And even in the case of this event-relatedness, powers are granted that go far beyond capital offenses, in that measures of predictive mass surveillance can also be used to prosecute burglary, receiving stolen goods, sports betting fraud, forgery and bribery.

Against such a political advance, even data retention, which we have been arguing about for almost 20 years now, seems like a walk in the park. In direct comparison, one might even wonder what the fuss was about when not only traffic data from a single telecommunications provider can now be analyzed on an ad hoc basis, but our highly sensitive biometric data can also be collected and analyzed en masse and without cause.

Digital asceticism does not really exist – and the state knows this too

And perhaps the biggest problem of all is that the more technological development progresses, the more serious the encroachment on our basic digital rights becomes. In many cases, we are already forced to share our personal data with others on social media and the internet in our social, professional and business lives alone. This is a form of surveillance that is becoming increasingly difficult, if not impossible, to avoid.

So if we are talking about the much-cited "transparent citizen", then this new legislative package is certainly the answer. Unfortunately, the German government itself does not even know exactly what it wants to achieve with these measures. The draft seems to throw algorithm-based AI buzzwords around at random without even carrying out a technology or risk impact assessment and without considering key issues relating to AI manipulation and discrimination in addition to data protection and data security.

Civil society engagement needed

However, despite all this bad news for our basic digital rights, there is at least one piece of good news: the legislative package on counter-terrorism that implements these measures has not yet been passed, at least for the time being. This is more than enough reason to inform people now and mobilize civil society to prevent this from happening – because once these powers for biometric-based mass Internet surveillance are implemented, the battle for our digital privacy will be lost for a long time.

Note: Prof. Dennis-Kenji Kipker has written an analysis (PDF) of the "Draft law to improve the fight against terrorism".

(mack)