Monday, November 12, 2007

Germany’s New Data Retention Laws

Last week, Germany’s ruling parties – a coalition of SPD & CDU, with efforts in the digital area recently spearheaded by minister of interior Wolfgang Schäuble (pictured) – passed a bill for new data retention laws*. With this law in place, people providing web/ phone services are now required to keep their website access logs, or their phone call logs, for half a year. This data can then be used by the authorities – police and secret services – if they suspect it may help in important criminal investigations, or when online crimes are committed. Self-proclaimed goal is to fight e.g. attacks against European cities, like the London or Madrid bombings. Some people now want to stop this law in Germany’s Federal Constitutional Court, which can overrule what is deemed anti-constitutional.

Now, the data you are required to keep doesn’t by itself contain the contents of the transmitted data, e.g. the words spoken in a phone call. It is mostly restricted to such things as the IP address, date and time of when e.g. an email account is accessed, or data like the email address of sender and recipients, according to Spiegel.de. However, some privacy experts, according to Tagesschau.de, say that with the connection data in hand, you can then locate other data, including sometimes the content of messages.

Google’s Global Privacy Counsel Peter Fleischer – who also has a blog – previously called such laws a “harsh attack on privacy” a while ago. He even went as far as saying “As a last fallback we will close Google Mail in Germany” should these laws be passed. Peter added that “Many users around the globe make use of this anonymity to defend themselves from spam, or government repression of free speech ... If the web community won’t trust us with handling their data with great care, we’ll go down in no time.” He also said that users of Gmail may simply switch to foreign email service providers anyway to better protect their privacy (if I remember correctly, Google later somewhat back-pedaled from these statements as they were given in an interview in German Wirtschaftswoche).

On the surface, the German Federal Ministry of the Interior agrees with Google. To quote from their website:

Only if people have confidence in data protection on the Internet, can the information society unfold its advantages. For this reason, the Federal Government is undertaking a fundamental revision of German data protection legislation. The aim is efficient data protection requiring as little control effort as possible.

Also, they say:

Law enforcement activities must be adapted to the dynamics of technological developments and the boundlessness of technology and networks. On the one hand, they must safeguard effective prevention and prosecution of new criminal offences, while on the otherhand [sic], utilize the electronic options available for law enforcement, without infringing upon citizens’ rights of freedom.

In other, related news, minister of interior Schäuble was pushing for a law to allow secret tools – trojans – to be installed on user’s computers for online supervision**. Also, according to Tagesschau.de, a recent case revealed that some German journalists’ and lawyers’ phone calls had been secretly tapped by the police as they were talking to informations/ clients (these people were allegedly extreme left-wing, and the talks were in relation to the then upcoming G8 conference).

*The German word here is “Vorratsdatenspeicherung,” an issue heavily discussed in German mainstream/ blog news.

**Coined “Bundestrojaner” or “Online-Durchsuchung” in Germany. The more official name for such tools is “Remote Forensic Software,” as Wikipedia explains.

[Thanks Hebbet! Photo by Bundesregierung.de from a video where Schäuble introduced the new biometric data as part of the travel pass.]

Update: It may be that Google’s Peter Fleischer referenced a now outdated version of the “Vorratsdatenspeicherungs” law in Germany – one that included a passage which required personal identification data during sign-up for email services. This part however has been removed from the bill in the meantime. The original Wirtschaftswoche article is gone from public view by now, and Heise’s article on the subject may or may not have gotten it slightly wrong. [Thanks Pjh!]

Germany’s New Data Retent ... by Philipp Lenssen | Comments (4+8)

>> More posts

Advertisement