New Rules for SIGINT Collection in Germany: A Look at the Recent Reform

Those following the Section 702 reauthorization debate may be interested in Germany’s recent intelligence reforms. One aspect of particular interest—which I also focus on in a new paper—is new limits on the collection of data from non-nationals outside of Germany, enforced in part by a new judicial oversight mechanism.

Context: Germany’s recent intelligence reform process

In December 2016, the most significant intelligence legislation in recent German history was finally put on the books. It followed a year of secret negotiations and a brief legislative process to codify new rules about the authorization, practice, and oversight of foreign data collection by the Bundesnachrichtendienst (BND), Germany’s foreign intelligence agency. Unlike most other countries, German intelligence law now contains specific restrictions on the collection of foreigners’ data. Foreigners will not be notified about surveillance measures, and therefore the restrictions I describe in further detail below are not procedural. However, the new law sets an additional international standard in requiring a panel of judges to authorize most foreign intelligence collection on a non-targeted basis.

A Compelling Case for Reform

The Snowden disclosures and subsequent far-reaching intelligence inquiry by the German Parliament were the impetus for the reform. The Bundestag’s inquiry into NSA surveillance quickly turned inward and brought to light major legal gaps, poor executive control, and grave democratic deficits concerning the governance of signals intelligence collection in Germany. A separate investigation by Germany’s parliamentary intelligence oversight body revealed that this practice has harmed German and European strategic interests and has led to unjustified spying on German and EU citizens, EU Member States and EU institutions, as well as international organizations.

Up until last year, Germany’s BND performed its single most important surveillance activity—collect against non-German nationals located outside of Germany—for decades absent a clear legal framework and without independent authorization and oversight. In German, that surveillance is called Ausland-Ausland-Fernmeldeaufklärung, which translates roughly to strategic foreign-foreign (meaning foreign persons on foreign soil) communications data surveillance. In Germany, strategic surveillance refers to the non-targeted, bundled collection of large quantities of communications data for foreign intelligence purposes. That surveillance power is distinct from surveillance activity directed at an individual suspect and his or her contacts. The table below distinguishes foreign-foreign strategic surveillance from other BND surveillance practices and informs whether a judicial review of the legality and necessity of these measures is being performed, and if so, by which committee.

Examples of BND current surveillance powers and their legal basis

The above table requires some further unpacking. “Foreign-domestic strategic surveillance” refers to one-end-foreign, one-end-domestic communications. For that authority, German intelligence law has long established a legal regime and oversight system, known as the Art. 10 Law. This is similar to an observation Bobby Chesney has made about U.S. practice, “if the “target of such collection is a (national) person, (national law) generally applies in such cases.” The Art. 10 Law protects German citizens at home and abroad, national residents, and legal entities in Germany from undue surveillance. It also requires notifications to allow for an effective remedy in case of a violation of their fundamental right to private communication guaranteed in Art. 10 of the German Constitution.

The 2016 intelligence reform left the entire Art. 10 Law and the institutional set-up for legality and necessity reviews for foreign-domestic strategic surveillance by the G10 Commission untouched. Instead, the 2016 intelligence reform filled a legal vacuum that existed in German legislation for the foreign-foreign communications that may be transiting and collected in Germany or that may be acquired abroad.

Below is a brief depiction, before I turn to these new provisions, of the basic set-up for the two types of strategic surveillance described above.

Both practices are of course very similar and employ the same tools. Yet, still, they require a different authorization and oversight trajectory via the Interior Ministry and the G10 Commission (for domestic-foreign strategic surveillance) or via the Chancellery and the Independent Committee (for foreign-foreign strategic surveillance). These are not minor differences and de jure the practice of domestic-foreign strategic surveillance is subjected to more robust oversight as shown by the different composition of the review bodies, their investigation powers, the notification requirements and the quantity restrictions. This said, there are many open questions as regards the actual implementation of the Art. 10 Law, including its quantity restriction, which has not been addressed by the 2016 reform.

The treatment of non-national data in Germany’s foreign intelligence legislation

Whereas there were no changes to the Art. 10 Law, the newly amended BND law now contains several new chapters, including new provisions regulating the practice, authorization, and oversight of strategic foreign-foreign communications data surveillance. Before, as the table below illustrates, there was only a general provision in the law that the BND is entitled to collect foreign data in keeping with its general mandate.

Pre-2016 reform framework for the BND’s foreign-foreign strategic surveillance

The reformed BND law now distinguishes between four different groups for which different authorization procedures, data protection standards, and oversight provisions apply with regard to the collection of content data for the practice of foreign-foreign strategic surveillance. The table below illustrates this in further detail.

Notice that the restrictions on the collection of non-national data do not apply to metadata. Put differently, the BND’s collection of metadata through strategic foreign-foreign communications data surveillance remains unrestricted. The retention of metadata is limited to six months. By contrast, content data may be retained for up to 10 years.

The foreign-foreign strategic surveillance measures require a collection order. Yet, depending on the different groups that these measures can be aimed at, the collection order may not mention the specific search terms that are being used by the BND to obtain specific information from the huge amount of data acquired by its strategic surveillance. Three things should be remembered here: First, a judicial review of the actual practice is much less meaningful without actual knowledge of the search terms used. Second, some of the circumstances referred to in legislation that may give rise to the use of search terms (see table below) are very broad. This shows that Germany assigns different data protection priorities to those four groups—with group A being the most protected. Third, Section 12 BND Law (Eignungsprüfung) provides for an important exception to the search term provisions. It states that “Telecommunication nets,” may be temporarily tested to assess the quality of their output and to generate new search terms.

For easier reference, the table below lists the different justifications for strategic surveillance measures known to German intelligence law:

My paper discusses the question whether these restrictions are meaningful and whether they can be honored in practice in further detail. It aims to provide a balanced account of the intelligence reform, reviewing the good, the bad, and what is missing.

The new limits on the collection of data from non-nationals outside of Germany and judicial oversight are too soft, and more investment is needed in effective judicial oversight for both strategic surveillance powers.

Despite the NSA-inquiry committee’s many important revelations—a public report is due next week—the 2016 intelligence reform did not draw the necessary conclusion, in my view, to substantially strengthen the system of judicial oversight in Germany.

Indeed, the BND reform created an authorization body for foreign-foreign strategic communications data surveillance by the BND. Yet, despite being staffed by professional jurists and its proximity to the Federal Court of Justice in Karlsruhe, the Independent Committee (UG) is neither independent nor a court. Instead, the Independent Committee may be referred to as an administrative body tasked with the ex ante authorization of the newly codified surveillance measures. Not only are its three members and deputies appointed by the executive, but one of the three members will also be a public prosecutor from the Federal Public Prosecutor’s Office. This is problematic for potential conflicts of interest.

What is more, the new provisions say very little on the Independent Committee’s actual oversight powers. By comparison, the G10 Commission (responsible for, among other things, the judicial review of foreign-domestic strategic surveillance) is not only tasked to authorize surveillance measures but also has the authority to review the collection, subsequent data handling and use of all personal data related to the surveillance measures. To exercise this oversight, the G10 Commission has guaranteed access to all documents, saved data and data management programs used in conjunction with surveillance measures, as well as access to any premises used for SIGINT purposes by all three federal intelligence agencies (Section 15.5 Art. 10 Law).

By contrast, the BND Law makes no mention of such judicial oversight powers for the Independent Committee. Apart from the missing provisions on the Independent Committee’s actual oversight powers, one can also express serious concerns regarding the authorization procedure for foreign-foreign strategic surveillance. More specifically, when the Independent Committee assesses the legality and necessity of a surveillance measure, it may do so on the basis of interception orders that do not list the search terms. Any legality and necessity assessment it makes without knowledge of the search terms is likely to lack credibility and substance.