German Intelligence Reform: More Powers for BND & BfV

Contents

What should intelligence services be allowed to do in the analog and digital space? For the Federal Republic, special rules have applied since the end of World War II: The democratic part of Germany had intelligence services. Operative activities for threat prevention have so far been fundamentally prohibited for both the domestic and foreign services. Precisely that is now set to change – at least to some extent.

At the Federal Chancellery, Interior Minister Alexander Dobrindt (CSU) and the Minister of State at the Federal Chancellery, Nina Warken (CDU), appointed at the end of July, presented the legislative changes to the Federal Intelligence Service Act and the Act on the Protection of the Constitution. For Dobrindt, this reform, which was sent to parliament today, is nothing less than a “new era”, in which the German services would be changed “towards becoming real intelligence services”. The goal is to be on an equal footing with other services, European ones in particular. Minister of State Warken, on the other hand, emphasized: The principle of an intelligence service that clarifies remains. The difference in emphasis is striking – yet both the Federal Office for the Protection of the Constitution and the Federal Intelligence Service will receive significantly more powers that go beyond intelligence activities than before. At least if the Bundestag supports the law.

Storage periods will be significantly extended

The reform thus provides for an expansion of the BND’s powers in data acquisition: In the future, the BND will be allowed to store content data for six months and communication metadata for twelve months and evaluate them for clues. The operators of the world’s largest Internet traffic exchange point, DE-CIX in Frankfurt, warn in this context of a massive expansion of surveillance. In her role as spokesperson for the CDU/CSU parliamentary group, the new Minister of State was part of the German Bundestag’s committee of inquiry into cooperation between the US technical intelligence service NSA and the German Federal Intelligence Service. In this capacity, Warken already had insights into both the creativity of the BND in interpreting its legal basis (“space theory”) and the problem of BND data interception from Internet exchange points and lines, using so-called selectors such as telephone numbers, email addresses, or search terms to look for intelligence-relevant content. One reason why Warken strongly emphasizes today that the control of intelligence services will also be strengthened in parallel.

The Office for the Protection of the Constitution should be able to manipulate data

Not only the Federal Intelligence Service, headquartered in Berlin and Pullach near Munich, but also the Federal Office for the Protection of the Constitution is to become more operational. In certain cases, it too should be able to use, among other things, “online searches”: the intrusion into end devices and the search of these, often called the federal trojan. If, in such “online searches”, corresponding material such as bomb-making instructions, assassination plans, or similar is found, targeted interventions in information technology systems should even be possible – for example, the exchange of individual files. However, this should only happen if there is a current danger.

Dobrindt justifies the expanded powers by stating that nowadays access to IT systems, from smart home systems like smart refrigerators to mobile phones, would be indispensable to be able to cope with the threat situation. Hybrid attacks are the order of the day.

The BfV will also receive another legal possibility that has so far been classically associated with police work: In the future, it should be allowed to secretly enter apartments itself. Furthermore, both services will be able to penetrate more deeply into clearly identified information technology systems, such as command-and-control servers that can be used for attacks on IT systems in the Federal Republic. If these can be clearly identified as attacker systems and not just as compromised third-party systems, the BND, for example, should be allowed to intervene here in the future.

In all these cases, it is about the services being allowed to take defensive measures themselves in the event of concrete dangers. Until now, they had to involve the respective responsible police authorities for actual threat prevention. According to Interior Minister Alexander Dobrindt, this was precisely a problem: Information from foreign intelligence services regularly could not be passed on beyond the services. In the world of intelligence services, it is said that whoever “possesses” information has the exclusive right to decide on its dissemination.

Control is being reorganized – effectiveness controversial

To ensure that all this takes place in a constitutionally secure manner, the Federal Government’s wish is that it will in future depend primarily on one actor: the so-called Independent Control Council (UK-Rat). It is to be requested for authorization before the most far-reaching measures and also to ensure overall that the German intelligence services comply with law and order. Overall, the control regime over the work of intelligence services will be further strengthened, says Warken. Constitutional limits, as critics complain, will not be exceeded. The protection of professional confidants such as doctors will also not be undermined.

BSI should not supply zero-days after all

Only at the last minute was a provision removed from the proposal that would have obliged the Federal Office for Information Security (BSI) to pass on security vulnerabilities to the intelligence services. There have been repeated reports in the past that the BND, for example, acts as a buyer on the black market for zero-day vulnerabilities – although this has never been officially confirmed. However, since numerous private and state entities are required to report to the BSI, such a disclosure obligation would have been an indirect notification to the BND – which apparently proved too politically sensitive.

In the next step, the members of the Bundestag are now responsible for the further processing of the extremely extensive draft law, which comprises 753 pages. A simple majority of the members of parliament would be necessary for the planned changes.

(wpl)