Karlsruhe retracts its stance
The Federal Constitutional Court of Germany has published a landmark ruling on the use of state Trojans (spyware) by police authorities. According to the ruling, state Trojans may only be used to investigate particularly serious crimes punishable by more than three years of imprisonment. Their use is prohibited for everyday crimes or offenses punishable by three years or less.
Key findings of the court include:
- Limited use for serious crimes: Only offenses punishable by over three years' imprisonment justify the use of state Trojans. Minor offenses (up to three years) cannot justify such intrusive surveillance.
- Proportionality and fundamental rights: The use of state Trojans, which intrudes deeply into a person's privacy and IT security, must be strictly proportional to the seriousness of the crime.
- Legal bases partly unconstitutional: The court found aspects of the current legal framework, such as online secret searches, formally unconstitutional due to insufficient specification of which fundamental rights are restricted. The legislature must revise these rules.
- Criticism of cooperation with private firms: The court hinted that state use of private spyware providers, like the NSO Group, represents an especially high risk and should be ended, due to the threats from such collaborations.
- IT security concerns: The ruling highlights a fundamental conflict where the state enables investigations by exploiting security vulnerabilities, thereby exposing not only suspects' but all IT systems to risk. The state itself must not become a threat to digital security.
In addition, the ruling declares source TKÜ for minor offenses (up to three years imprisonment) unconstitutional and completely strikes down this authority. However, the plaintiffs in the state trojan cases had expected a more comprehensive reconsideration of the state trojan practice, but the court's ruling did not deliver this. Therefore, the permission for online search remains in effect until the legislator improves it.
The ruling is similar in nature to previous rulings on the Bundesnachrichtendienst-Gesetz and data retention, as it focuses on correcting surveillance practices rather than prohibiting them. The Constitutional Court rarely prohibits surveillance completely and instead focuses on correcting it piecemeal, as seen in the ruling on state trojans.
- The Federal Constitutional Court's ruling on state Trojans is based on the principle that their use should be limited to seriously punishable crimes, as their intrusive nature into privacy and IT security must be proportional to the crime's severity.
- As a result of the ruling, the source TKÜ, which permits the use of state Trojans for minor offenses, is found unconstitutional, signifying stricter regulations in the future concerning the use of technology for surveillance purposes.
