Federal Constitutional Court: When spying on with state trojans is unconstitutional

Communication often takes place in digital space today. In law enforcement, encrypted chats or calls via messenger services such as Telegram and WhatsApp present the investigators with new challenges. A reform of the Code of Criminal Procedure should remedy the situation in 2017. But above all the powers contained therein on the use of state spy software-also called state trojans-caused criticism.

The powers of the law enforcement officers also go too far in their current form to the Federal Constitutional Court. This is shown by a decision of the Supreme German Court published on Thursday. The first Senate declares the legal regulations to be unconstitutional – and sets new limits for the secret surveillance to investigate crimes.

Which law is it about?

The Code of Criminal Procedure (StPO) regulates the implementation of criminal proceedings and the powers of the investigative authorities in Germany. In summer 2017, it was reformed by the “Law on the more effective and practical design of the criminal proceedings” by the then grand coalition of the Union and SPD. Even then, the law triggered great protest-mainly because of the possibilities of arrangement of source telecommunications monitoring (source TKÜ) and online searches with the help of so-called state trojans.

State Trojan is referred to, which is installed on his computer or smartphone without knowing the suspect. For example, the investigators can read messages about messenger services such as WhatsApp that are transmitted between devices (source-tkü) or even search through all data on the device (online search).

What is source telecommunications monitoring?

In classic telecommunications monitoring, the communication of a suspect is recorded, for example, via telephone, email or chat messages. Measuring services such as WhatsApp or Telegram often encrypt the chat messages and calls from their users. In order for investigators to get this data in the law enforcement, communication at the source TKÜ is recorded before it is encrypted or after it has been deciphered. For this purpose, special software is accessed directly to the end device (the “source”).

What is an online search?

The so-called hidden online search goes one step further. Here, too, the responsible law enforcement agency intervenes with technical means in the suspect’s end device and collects data from it. In contrast to the source TKÜ, surveillance is not limited to ongoing communication, but refers to all data on the device.

What standards have been used to measure so far?

Certain requirements were applied for the use of a source-tok or online search. For example, they presuppose the suspicion of a severe or-in the event of an online search-particularly serious criminal offenses that are listed in the law. These include murder, homicide or falsification of money. In addition, the crime had to weigh heavily or particularly difficult in individual cases and the investigation should be much more difficult or hopeless in other ways. The measures had to be ordered by a judge.

What does the Federal Constitutional Court say?

The Karlsruhe Senate declared the source TKÜ in the investigation of crimes, for which a prison sentence of a maximum of three years threatens, declared unconstitutional and void. So it is also invalid. “The legislator cannot bring about a constitutional regulation with a comparable regulatory content even by improvement,” says the reason.

The Source TKÜ is a very serious intervention in fundamental rights, explains the court. “It enables the entire raw data stream to be removed and evaluated and thus has an extraordinary reach, especially under the current conditions of information technology and its importance for communication relationships.”

In order to protect the proportionality, the measure must be limited to the persecution of particularly serious crimes. This did not include those for which up to three years in prison or a fine.

In addition, the authority of the investigators for the secret online search of computers or smartphones from suspects was not compatible with the Basic Law, the court decided. In contrast to the source TKÜ, the judges are of the opinion that the legislature can eliminate the constitutional concerns by taking into account the letting secret stated in the Basic Law. The previous provision continues to a new regulation. (Az. 1 BvR 180/23)

How often do the measures have occurred so far?

The Federal Office of Justice regularly publishes figures on how often TKÜ and online searches are arranged and carried out in practice. As can be seen from a statistics published on Tuesday, there were a total of 104 judicial orders for the Quellen-TKÜ in 2023. In fact, 62. the year before, there were 94 orders, 49 of which were carried out.

According to the statistics, online searches are much less common. In 2023, this measure was ordered only 26 times by a judge and carried out six times. In most cases, it was about the accusation of forming a criminal association.

According to the DigitalCourage association, the decision from Karlsruhe is his constitutional complaint initiated in 2018. Among other things, the association criticized that the state trojans were installed in smartphones or computers via security gaps. In addition to the police, these back doors could also use criminals to access devices. The state thus violates its obligation to protect. Digitalcourage had also lodged a complaint against the use of state trojans in the police law of the State of North Rhine-Westphalia, which was now rejected in Karlsruhe.

What was the second complaint about?

While the Code of Criminal Procedure regulates the so -called repressive tasks and powers of the police in the investigation of crimes, the preventive tasks are regulated in the police laws of the federal states – that is to prevent dangers to public security and order. According to the police law North Rhine-Westphalia, the source TKÜ is also allowed there. The Karlsruhe judges and judges today gave the green light. In her view, the regulation was sufficiently limited to particularly heavy – terrorist – crimes.