Under what circumstances does monitoring state troopers violate constitutional rights?
In a landmark ruling, the Federal Constitutional Court of Germany has decided to limit the use of state Trojans in digital surveillance measures, citing a disproportionate intrusion on privacy and IT fundamental rights.
The Court's decision centres around the severity of interference with fundamental rights through digital surveillance measures, such as the deployment of state Trojans. The Court ruled that the police may no longer use state Trojans for offenses punishable by a maximum prison sentence of three years or less, as such use constitutes a disproportionate and severe intrusion on privacy and IT fundamental rights.
The ruling also found the legal basis for secret online searches (§ 100b(1) StPO) to be unconstitutional on formal grounds. The law failed to specify which fundamental rights were restricted, violating Article 19 of the Basic Law which requires precise elucidation of encroached rights. The law only cited restrictions on the IT fundamental right but omitted the secrecy of telecommunications under Article 10 of the Basic Law, which is also affected.
The decision underscores that the use of state Trojans involves a particularly serious encroachment on fundamental IT and privacy rights, demanding very high justification. Their deployment is only permissible when investigating serious crimes, not "everyday" or less serious offenses.
The legislation governing remote searches and use of state Trojans must comply with formal constitutional requirements by explicitly specifying the fundamental rights infringed and ensuring proportionality.
The ruling partially declares the investigators' authority for secret online searches of suspects' devices unconstitutional. The Criminal Procedure Code (StPO) in Germany, which regulates criminal proceedings and the powers of investigative authorities, was reformed in summer 2017, causing protests due to its provisions for source telecommunications surveillance (source-TKÜ) and online searches using state trojans.
In 2023, there were a total of 104 judicial orders for source-TKÜ, of which 62 were carried out. In the previous year, there were 94 orders, of which 49 were carried out. An online search was ordered a total of 26 times and carried out six times in 2023, primarily in investigations into the suspicion of forming a criminal organization.
Digitalcourage, a digital rights association, criticised the use of state trojans, which can be installed via security vulnerabilities in smartphones or computers, as a failure of the state's protective duty. The decision from Karlsruhe is in response to a constitutional complaint initiated by Digitalcourage in 2018.
The current provision for secret online searches remains in effect until it is revised. The court ruled that the measure should be limited to the pursuit of particularly serious crimes, excluding those punishable by up to three years imprisonment or a fine. The Federal Constitutional Court has declared the use of source-TKÜ for crimes punishable by up to three years imprisonment unconstitutional and void, with retroactive effect.
The Karlsruhe judges have given the green light for the use of source-TKÜ in the Police Act of North Rhine-Westphalia, limiting its use to particularly serious - terrorist - crimes. The First Senate of the Federal Constitutional Court has declared some of the legal provisions related to these powers unconstitutional and set new limits for secret surveillance.
In summary, the Federal Constitutional Court held that state Trojans constitute a severe interference with constitutional rights and restricted their lawful use exclusively to serious criminal investigations while declaring parts of the current legal framework unconstitutional due to formal deficiencies in rights specification and proportionality safeguards.
The Federal Constitutional Court's ruling on state Trojans emphasizes the serious infringement on fundamental IT and privacy rights, justifying their use only for investigating serious crimes, not for less severe offenses. In addition, the Court highlighted the importance of data-and-cloud-computing technology in digital surveillance measures, stating that future legislations governing these measures must comply with constitutional requirements, specifically by explicitly specifying the fundamental rights infringed and ensuring proportionality.
