Article 10 Act: The constitution also applies to the Office for the Protection of the Constitution
We are taking the Article 10 Act to the European Court of Human Rights.
Photos, videos, private messages and stored contacts. With the spying software known as the state trojan, secret services can read out the data of end devices such as smartphones or computers without being noticed. The amendment of the Federal Constitutional Protection Act and the Article 10 Act has been allowing all 19 secret services to use this measure since mid-2021 – without sufficient control and low-threshold.
The access to the end devices takes place secretly and is usually not disclosed afterwards, so that those affected cannot defend themselves against it. This clearly endangers the protection of the secrecy of telecommunications under Article 10 of the Basic Law. Since not only current communication is intercepted, but state trojans can also read out stored communication files, the so-called fundamental right of guaranteeing the confidentiality and integrity of information technology systems is also violated (Art. 2 para. 1 in conjunction with Art. 1 para. 1 GG).
However, not only the use of state trojans is problematic. The procurement and prerequisite for the use of state trojans in the first place also forces the government into a fundamental rights dilemma.
THE GOVERNMENT LEAVES GAPS OPEN AND RISKS CYBER ATTACKS
State trojans infiltrate end devices such as smartphones or computers through security vulnerabilities. These vulnerabilities exist due to flaws in the devices' software. In order to prevent foreign interference, the gaps would have to be reported to the manufacturers and then fixed. However, the government does not do this. Instead, it buys information about security vulnerabilities on the black market and uses it for its own surveillance purposes.
The Federal Constitutional Court has made it clear in the past that the government has a duty to protect IT security. This means that the government is obliged to actively contribute to the protection of information technology systems, e.g. in the form of a statutory vulnerability management in dealing with known IT security gaps. If the government exploits these gaps, it endangers the integrity of these systems and does not fulfil its duty to protect IT security.
GOING AFTER UNRESTRICTED DATA COLLECTION
We are also taking legal action against the intelligence information system (NADIS) before the ECtHR. German intelligence agencies use this system to share the data they have gathered—including a great amount of highly sensitive data obtained by using state trojans, among other means. There are currently hardly any regulations governing what data the services are allowed to store in NADIS and for how long, nor what rules apply to their interpretation. The court must also set effective limits for the intelligence services in this regard.