The Federal Intelligence Service (BND) is to receive a broad license to hack “foreign switching systems, telecommunications infrastructure” or comparable IT systems from providers. The federal cabinet approved a corresponding draft for reforming the BND law on Wednesday. It is intended to legalize extensive surveillance practices of the international secret service and create new powers.

The Federal Government considers it necessary to hack telecommunications providers in other countries, since the BND, in contrast to domestic providers, could “not set up cooperative access”. Therefore, the secret service needs permission to access relevant data “by secret means” or to access the technology and to “overcome security measures”.

The government now wants to officially authorize the BND to carry out individual monitoring in the form of interventions in the IT systems of foreigners abroad using technical means such as the federal Trojan. She admits that the agents are currently carrying out such state hacking. However, the “principle of proportionality” and “strict formal hurdles” would be observed. In the future there will be a legal basis.

Important searches Such secret online searches are important because of that the BND could still fulfill its mandate in view of the increasing use of “unsolvable encryption methods”, according to the draft. The aim of such interventions in the basic rights of those affected are usually not “personal IT devices” such as smartphones, “which can contain a large amount of private information”, but systems or infrastructures used for business such as “network elements of a military facility in a crisis state”.

The actual reason for the amendment to the law is the judgment of the Federal Constitutional Court on the suspicion-independent mass surveillance of the Federal Intelligence Service in the form of strategic telecommunications intelligence. The court declared the data vacuum cleaner used for this purpose unconstitutional. They also gave detailed advice on what the reform should look like and gave lawmakers until the end 2021 an opportunity to improve.

The government designates this Instrument and data collection from IT systems abroad as indispensable. Unchanged, network communication withdrawn there should only be permitted on the basis of selectors. The monitoring using thousands of search terms 2018 produced usable results, but none.

Since the handling of the data vacuum cleaner and the evaluation of the captured material is not trivial, the BND should even be able to call on the help of friendly secret services such as the NSA or the British GCHQ. According to the draft, it “may request foreign public authorities to carry out strategic information measures”. This is not a problem, since the selectors used must meet the same requirements as with the BND.

Only some search terms The international secret service may only use and pass on search terms that are “specific, suitable and necessary”. “Their use must be in harmony with the foreign and security policy interests of the Federal Republic”. Personal data from citizens and institutions of the EU as well as from public bodies of the member states may not be collected “specifically” or only with increased requirements. Somewhat higher requirements also apply to data from a confidentiality relationship, for example with clergy, defense lawyers, lawyers and journalists. The core area of ​​private life must not be touched is generally permissible. In spite of this, the government refers to the goal of excluding the “so-called ring swap” when collecting data between secret service partners through the specifications. Observers assume that with these clauses the local agents will also be able to outsource the operation of the NSA tool XKeyscore and also use the huge data center of the US secret service in Utah.