Surveillance of Messenger Apps & Co – How Far May The State Go

Criminals, investigators say, no longer arrange to meet in the dark corner of the station or make anonymous calls via prepaid cell phones. The technology has long since advanced, chats are encrypted. Everyone who uses messenger services such as WhatsApp automatically protects their messages and conversations with software. Even criminals know that.

In addition, people today can access the Internet in many places. Those who have a smartphone communicate from home, but also in trains, cafés or hotels. Criminals, like nomads, can change their access to the net. And use it to cover their tracks.

How justice and the police must react to ever better encrypted technology and ever more intensive online use is currently one of the most important debates in security policy. And a very controversial one. The state as a spy – how far can it go?

Last year, the German government expanded its powers to monitor messenger services and online searches. Under certain conditions, law enforcement agencies are allowed to use software to access computers and mobile phones of suspected criminals – and even search them like an apartment. Several politicians, data protectionists and journalists have now filed a complaint with the Constitutional Court against these new powers.

The “State Trojan”

For several years now, the Federal Criminal Police Office and, more recently, the Central Office for Information Technology in the Security Sector in Munich have been working on software that enables investigators to infiltrate computers and mobile phones. Critics speak of the “state Trojan”. What the state does is basically nothing better than people spying on others through spy apps such as well-known Flexispy. This test shows the entire potential of surveillance programs on your mobile. Imagine, this is what the state does. They may – but citizens are criminals if they do so?

surveillance by the stateTwo cases can be distinguished. First, with a software, investigators sit down on a mobile phone or a computer and copy chats, for example at WhatsApp. They go to the “source” of the communication, such as the mobile phone, and thus circumvent the encryption. Secondly, they do an online search. Here too, law enforcement officers use spy software – and want to gain access to all data on a computer or mobile phone: Photos, files, programs, but also the whereabouts of the person, which are often automatically recorded by the mobile phone. Investigators can also view online banking.

This software is intended to solve a dilemma for investigators: Conventional surveillance of telephones or the home is increasingly falling short in the eyes of the prosecutor. According to the German Federal Criminal Police Office in 2016, 67 percent of the surveillance measures included encrypted messenger communication via programs such as WhatsApp, Telegram, Viber.

The police has invested almost six million euros to develop a surveillance program itself. According to its own statements, the police has only ordered the serious intervention of online searches in seven cases so far.

It is also unclear how good the security authorities’ software is. In a first version of the police Trojan, for example, only the Skype program could be monitored. A second, apparently better version has now been released by the Federal Ministry of the Interior for the hunt for criminals. How far the technical possibilities for digital eavesdropping attack go, neither authorities nor the government give information about. They do not give details about the programs. At least: Data protectionists have also checked the program.

The new Law

In the summer of 2017, an amendment to the Code of Criminal Procedure gave investigators more powers to use this software to monitor cell phones and computers. While online searches have only been used very narrowly in the fight against terrorists since 2008, investigators are now allowed to listen in on chats and read out entire computers with the help of source TCTV even in cases of everyday crime.

Trojan software can now be used by law enforcement officers against drug dealers, fences, bank robbers and asylum fraudsters – especially when police officers cannot get anywhere with conventional surveillance, such as telephone surveillance. The policemen’s argument: not only terrorists, but also criminal rockers and smugglers use encrypted chats – hardly anyone communicates over the phone.

The legislator has also set up hurdles for the use of surveillance software: For example, no “core areas of private life” may be monitored. Lawyers, members of parliament, doctors and journalists are also better protected against state measures. The use of the software must be approved by a judge. The public prosecutor’s office and the police are therefore unable to listen to encrypted chats on their own initiative – unless there is a concrete danger “in delay”, for example if a crime could be imminent or human lives are threatened.

The Critics

Above all leftists, data protectionists, lawyers and journalists are sharply critical. “Even people suspected of having committed a crime must not be subjected to a total investigation”, the critics say.

Critics is also pressing for greater control of police surveillance measures by Bundestag committees. In addition, the use must remain reduced to crimes such as terrorism. Critics such as Thomae want their constitutional complaint to ensure that judges make clear guidelines on how strong the suspicion of a crime must be for the police to be allowed to monitor online. At the same time they want clarity about how Trojan software automatically deletes sensitive data such as intimate chats or photos.

Online searches and source TCT are even a risk to security. Authorities buy espionage software from companies, too. The state is thus not only fueling a controversial market for spy software. The German government refuses to provide information about cooperation partners and companies, citing the protection of Germany’s “security interests”.

And: In order to penetrate mobile phones or computers, IT specialists as well as investigators use security holes in the devices. Instead of providing information about technical errors, a tiny group of criminals is being hunted down at the expense of the freedom and security of all citizens.