GERMANY: Telecommunication providers to intercept customers
01 August 2001
On 24 October, the government passed a new Telecommunications and Surveillance Regulation (TKÜV, Telekommunikations-Überwachungsverordnung).The regulation lays down the technical and organisational measures, which providers will have to implement, to allow for the interception of telecommunications such as fixed line and mobile phones, text messages, faxes and e-mails. The legal basis for the interception is already laid down by provisions under the Criminal Code, the Foreign Economy Law (Außenwirtschaftsgesetz) and the newly amended G-10 Gesetz, which restricts the right to privacy in telecommunications (see Statewatch vol 11 no 3 & 4). Internet service providers are excluded from the new provisions, however:
So that this [exemption] does not create... gaps in surveillance, the providers of transmissions which serve direct, user-specific Internet access (eg. ADSL connections) are obliged to take the relevant measures. E-mail account providers continue to be bound by law to provide the relevant technical provisions."
The regulation forces providers to implement the interception measures at their own cost. Further, telecommunications companies are forced to immediately implement surveillance on demand by the relevant authorities. An unsigned fax, either from judges, public prosecutors, the police or internal and external security services, can require companies to intercept their customers. The promised far-reaching discussion on this contested provision has not taken place, instead the Cabinet passed the regulation as an emergency anti-terrorist sanction.
Although the government claims that only the telecommunications of those under surveillance will be intercepted, a wide range of civil liberties groups have argued that this will not be possible due to the provision enabling internet surveillance, including chat rooms and mailing lists, thereby extending the interception to non-suspects. Furthermore, service providers are obliged to keep secret their interception activities and not leak the information gathered. This, according to internet specialists, is impossible to guarantee.
As in the G-10 Gesetz, the regulation is not subject to a "success control", which would monitor whether it achieves its objectives of fighting crime. In the past, interception laws, just as with stop and search powers, have proved incapable of reducing or even detecting crime (see Statewatch vol 11 no 3 & 4 and vol 11 no 2). Although the providers will have to keep statistics on their interception activities, these are only available to the authorities, making public accountability unlikely. The regulation does not call for the outright abolition of encryption, but it demands from providers so-called "backdoor" devices for the cryptography keys they provide. Internet activists have predicted an encryption paragraph will be "slipped in" with the still outstanding technical guidelines for the TKÜV.
The regulation, rather than being a national provision, follows a proposed EU Council Resolution (20 June 2001, document number 9194/01) "on law enforcement operational needs with respect to public telecommunication networks and services", that was not adopted because of privacy concerns. It states:
The Council calls upon Member States to ensure that, in the development and implementation - in cooperation with communication service providers - of any measures which may have a bearing on the carrying out of legally authorised forms of interception of telecommunications, the law enforcement operational needs, as described in the Annex, are duly taken into account.
See http://www.big-brother-award.de/current/comm/ for background information on the Regulation, http://www.bmwi.de/textonly/ Homepage/download/telekommunikation_post/TKUEV1.pdf for the Regulation in pdf format and http://www.bundesregierung.de/ frameset/index.jsp for the government's take of the new regulation with regard to civil liberties.