Ruling in Germany

BND powers for cyber surveillance unlawful

According to the press release, the amendment to the law introduced in 2015 is about the risk of an international criminal, terrorist or state attack, for example by means of malware, "on the confidentiality, integrity or availability of information technology systems and networks in cases of considerable importance relating to the Federal Republic of Germany."

(Bild: APA/dpa/Wolfgang Kumm)

Despite the growing danger of international cyber attacks, the current powers of the German Federal Intelligence Service (BND) to monitor telephone calls, for example, go too far. Rules on the collection and processing of personal data are partly unconstitutional, according to a ruling.

Rules on the collection and processing of personal data for secret strategic domestic-foreign telecommunications surveillance in the area of cyber threats violate the secrecy of telecommunications, the Federal Constitutional Court has ruled. The law must now be improved on several points by the end of 2026.

Among other things, data from purely domestic telecommunications traffic would have to be separated out. In addition, no search terms relating to the core area of private life may be used against foreign persons abroad.

The decision does not relate to foreign-foreign telecommunications reconnaissance under the BND Act, which involves the surveillance of telecommunications traffic in which only foreign actors abroad are involved. In general, the foreign intelligence service may not strategically monitor telecommunications traffic involving only German nationals or people in Germany on both sides.

Maintaining proportionality
The court emphasized that the potential threat of international cyber attacks is extremely high and their number is increasing. Attacks on critical digital infrastructures or similarly important information technology systems are aimed at destabilizing the community. They could threaten the constitutional order, the existence and security of the federal government or the federal states, as well as life, limb and freedom. The danger of such attacks on the IT infrastructure of elementary and vital areas - such as the supply of water and energy as well as transportation and healthcare - could reach a level comparable to the danger of an armed attack.

There is therefore an overriding public interest in recognizing cyber threats from abroad that are of foreign and security policy significance at an early stage. The authority for strategic domestic-foreign surveillance is therefore fundamentally compatible with the Basic Law, the court stated. "However, it must be proportionate."

On the other hand, the court emphasized that strategic telecommunications surveillance is an instrument of particularly serious intrusiveness. This applies above all because it is permitted against any person without cause and is guided solely by specific purposes. "Under today's conditions of communication technology and its significance for communication relationships, it has an extraordinary scope."

In addition, the intelligence services' analysis options have developed further, it said. The possibility of using formal search terms has brought strategic surveillance closer to individual telecommunications surveillance.

Human rights organizations welcome ruling
The Federal Constitutional Court has strengthened the confidentiality of communications, according to the Gesellschaft für Freiheitsrechte (GFF), which brought one of the lawsuits together with the human rights organization Amnesty International (AI). The secret service work was brought back "to the ground of the Basic Law", explained Bijan Moini from the GFF.

"If human rights organizations have to fear that their sensitive communications are being read in the course of unprovoked mass surveillance, this endangers their work," explained Lena Rohrbach from AI in Germany. In a representative survey conducted by the organization, 20 percent of respondents stated that they would restrict their communication behavior out of concern about disproportionate state surveillance.