Germany's authorities should at least report security breaches

Contents

Federal authorities are to report IT security vulnerabilities to the Federal Office for Information Security (BSI) as soon as they become aware of them and "insofar as this does not conflict with other statutory regulations". The SPD and Green negotiators who remained in the coalition following the departure of the FDP have agreed on this regulation. This is to be included in the BSI Act, paragraph 43, in a new paragraph 6.

The draft is available online at heise. The traffic light coalition started with the promise in the coalition agreement to strengthen IT security. According to the agreement, the state should "not buy or keep open any security gaps", but "always strive to close them as quickly as possible" under the leadership of a more independent BSI. At the same time, the intervention thresholds for surveillance software such as state Trojans should be raised and the existing powers of the police should be restricted.

However, a working group of interior politicians from the coalition parties and the Federal Ministry of the Interior (BMI) failed to reach a common denominator on the issue of vulnerability management for months. It was not until the spring that there was hope of an agreement. Before the summer break, the three parliamentary groups actually came to an agreement, but the way the BMI subsequently formulated the compromise was particularly offensive to the Greens and the Liberals in view of too many backdoors for the exploitation of vulnerabilities by security authorities.

No comprehensive statistics

As part of its draft for the implementation of the EU Network and Information Security Directive, known as NIS2, the German government then proposed a section 43 (5) in the BSI Act. This does not go as far as the additional paragraph 6 now agreed by the SPD and the Greens. According to the government's approach, vulnerabilities only have to be reported if information about them is "important for the fulfillment of tasks or for the security of federal communications technology". There is also a range of exceptions, which even refer to "confidentiality or agreements with third parties".

There is not even supposed to be any useful data on the extent of the problem: The Federal Intelligence Service (BND) and the Federal Office for the Protection of the Constitution (BfV) are to be exempt from the requirement to keep annual statistics on known security breaches.

No "non-transparent" disclosure of security gaps

According to the red-green agreement, the more far-reaching paragraph 6 is to be added. However, this compromise is only a reporting obligation and therefore does not generally rule out the possibility of security authorities deliberately keeping gaps open in order to use them to install state Trojans on third-party devices, for example. In 2021, the Federal Constitutional Court called on legislators to regulate how government agencies deal with vulnerabilities in order to realize the fundamental right to confidentiality and integrity of IT systems.

The Greens would have preferred a formulation "that prioritizes general IT security in Germany", Konstantin von Notz, deputy leader of the parliamentary group, and his colleague Misbah Khan, who was involved in the negotiations, told heise online. However, more was not possible with the SPD. Nevertheless, the compromise "would lead to a significant improvement compared to the status quo: It is important that the legislator sets out a clear line for dealing with vulnerabilities known to the state."

Empfohlener redaktioneller Inhalt

Mit Ihrer Zustimmung wird hier eine externe Umfrage (Opinary GmbH) geladen.

Umfrage jetzt laden

Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (Opinary GmbH) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.

The previously practiced non-transparent keeping open of vulnerabilities on the basis of simple administrative regulations, which threatened to cause major economic and security policy damage, would no longer be possible. Comprehensive exceptions to this principle have been averted.

Tighter focus on critical components

The SPD and Greens are also signaling white smoke when it comes to the NIS2 Implementation Act as a whole. Their over 220-page amendment to the government bill contains a revised "Huawei clause", for example. The previous one sets a comparatively high hurdle for the exclusion of individual equipment suppliers from network expansion for 5G, for example. The government can thus prohibit the use of "critical components" in the event of "probable impairments to public safety and order". Manufacturers must provide a guarantee declaration. The BMI is responsible for a ban. However, it must "consult" with the departments concerned, such as the Ministry of Economic Affairs and the Federal Foreign Office.

The provision currently used once with a focus on Huawei and ZTE previously only applied to the telecommunications sector. In future, the BMI is to determine critical components for sectors with critical infrastructures (Kritis) in agreement with the responsible federal ministry in ordinances that do not require the approval of the Bundesrat and prohibit their use if necessary.

The telecommunications operators, who were previously the only ones covered, also had to notify the BMI that they wanted to use technology from controversial suppliers such as Huawei. According to the red-green plan, this requirement will be replaced by a registration obligation for all critical areas. Operators will also have to provide the BSI with information on the types of critical components they use. The Green negotiators explain that this will create an overview database at the authority and, "in combination with the operators' duty to cooperate, achieve faster reaction times in the event of specific threats and findings". The guarantee declaration is no longer required.

BSI to become "technically independent"

Although the BSI itself is to remain linked to the BMI, it is to be "autonomous" and work "professionally independently". Details are to be regulated by annual target agreements, the content of which the Ministry of the Interior must report to the Bundestag's Committee on Internal Affairs. The Federal Ministry of the Interior would have to provide written justification for any instructions given to the BSI –, especially if they could be "politically sensitive", such as the public warning about software from the Russian IT security company Kaspersky.

The SPD and the Greens have formulated the position of the proposed Chief Information Security Officer (CISO) of the federal government in more concrete terms and placed it in the BSI, which is responsible for the subject matter. The government would have preferred the BMI. The federal CISO is not to be subject to any directives in the performance of his duties, which extend to penetration tests for authorities. The aim here is to make the BSI more independent overall.

The federal government's approach of exempting state and municipal administrations from the stricter IT security requirements imposed by the NIS2 and often relying on self-regulation for federal authorities has long been criticized. A relevant obligation on the part of the federal administration is still an open point.

The Greens believe that such a step would be necessary in the interests of effective state resilience. Representatives of the CDU/CSU parliamentary group also support this. The government has now sent the parliamentary groups a "formulation aid" that extends the minimum protection to the entire federal administration. It is – subject to funding – part of the negotiation package.

Decision before the election questionable

Theoretically, the NIS2 Implementation Act could still pass through the Bundestag in the remaining two weeks before the new elections in February. However, the remaining parliamentary coalition does not have a majority on its own. Von Notz and Khan are therefore appealing to the CDU, CSU and FDP to "come to a result together and quickly for Germany's security". Ultimately, there can be no delay: "The threat to our digital lifelines is too great" to allow months to pass. In addition, the EU Commission has already initiated infringement proceedings against Germany due to the lack of NIS2 enforcement.

There are also reports from SPD circles that talks are underway with the CDU/CSU and the Liberals, as a prompt decision would be very important. FDP interior affairs expert Manuel Höferlin did not comment on the project when asked by heise onlines on Monday.

(ds)