Order of 24 June 2025

R e a s o n s :

A.

1

The constitutional complaint concerns authorisations in criminal procedural law to carry out source telecommunications surveillance and remote searches.

I. 

2

With their constitutional complaint, the complainants challenge § 100a(1) second and third sentence, § 100a(3) through (6), § 100b and § 100d(1) through (3) and § 100d(5) of the Code of Criminal Procedure (Strafprozessordnung – StPO) as amended by the Act to Improve the Effectiveness and Practicality of Criminal Proceedings (Gesetz zur effektiveren und praxistauglicheren Ausgestaltung des Strafverfahrens) of 17 August 2017 (Federal Law Gazette, Bundesgesetzblatt – BGBl I p. 3202), which entered into force on 24 August 2017. The provisions in the version challenged here read as follows:

§ 100a of the Code of Criminal Procedure – Telecommunication surveillance

(1) ¹Telecommunications may be intercepted and recorded even without the knowledge of the persons concerned if

1. certain facts give rise to the suspicion that a person has, either as an offender or participant, committed a serious crime of the kind referred to in subsection (2) or, in cases where there is criminal liability for attempt, has attempted to commit such an offence or has prepared such an offence by committing another offence,

2. the offence is one of particular severity in the individual case and

3. other means of establishing the facts or determining the accused’s whereabouts would be significantly more difficult or offer no prospect of success.

²Telecommunications may also be intercepted and recorded in such a manner that technical means are used to interfere with the information technology systems used by the person concerned if this is necessary to enable interception and recording in unencrypted form in particular. ³The content and the circumstances of the communication stored in the information technology systems of affected persons may be intercepted and recorded if they could also have been intercepted and recorded in encrypted form during ongoing transmission processes in the public telecommunications network.

(2) Serious crimes for the purposes of subsection (1) no. 1 are:

1. under the Criminal Code (Strafgesetzbuch – StGB):

a) offences against peace, high treason, endangering the democratic state under the rule of law, treason and endangering external security under §§ 80a through 82, 84 through 86, 87 through 89a, § 89c(1) through (4) and §§ 94 through 100a,

b) taking of bribes by and giving of bribes to elected officials under § 108e,

c) offences against national defence under §§ 109d through 109h

d) offences against public order under §§ 129 through 130,

e) counterfeiting of money and official stamps under §§ 146 and 151, in each case also in conjunction with § 152, and § 152a(3) and § 152b(1) through (4),

f) offences against sexual self-determination in cases under §§176a and 176b and, under the conditions of § 177(6) second sentence no. 2, in cases under § 177,

g) dissemination, procurement and possession of child and youth pornography under § 184b(1) and (2) and § 184c(2),

h) murder under specific aggravating circumstances and murder under §§ 211 and 212,

i) offences against personal liberty under § 232, § 232a(1) through (5), § 232b, § 233(2), §§ 233a, 234, 234a, 239a and 239b,

j) gang theft under § 244(1) no. 2 and aggravated gang theft under § 244a,

k) robbery or extortion under §§ 249 through 255,

l) commercial handling of stolen goods, handling of stolen goods as a member of a gang and commercial handling of stolen goods as a member of a gang under §§ 260 and 260a,

m) money laundering or concealing unlawfully acquired assets under § 261(1), (2) and (4); if criminal liability is based on the fact that impunity pursuant to § 261(9) second sentence is ruled out under § 261(9) third sentence, then only where the object is derived from one of the serious crimes referred to in nos. 1 through 11,

n) fraud and computer fraud under the conditions of § 263(3) second sentence and in the case under § 263(5), in each case also in conjunction with § 263a(2),

o) subsidy fraud under the conditions of § 264(2) second sentence and, in the case under § 264(3), in conjunction with § 263(5),

p) sports betting fraud and manipulation of professional sports competitions under the conditions of § 265e second sentence,

q) offences involving forgery of documents under the conditions of § 267(3) second sentence and in the case under § 267(4), in each case also in conjunction with § 268(5) or § 269(3), and under § 275(2) and § 276(2),

r) bankruptcy under the conditions of § 283a second sentence,

s) offences against competition under § 298 and, where the conditions of § 300 second sentence are fulfilled, under § 299,

t) offences constituting a public danger in the cases under §§ 306 through 306c, § 307(1) through (3), § 308(1) through (3), § 309(1) through (4), § 310(1), §§ 313 and 314, § 315(3), § 315b(3), and §§ 361a and 361c,

u) taking and giving of bribes under §§ 332 and 334

2. under the Fiscal Code (Abgabenordnung – AO):

a) tax evasion under the conditions of § 370(3) second sentence no. 1,

b) smuggling on a commercial basis, with the use of violence or as a gang under § 373,

c) handling goods obtained by tax evasion as defined in § 374(2);

3. under the Anti-Doping Act (Anti-Doping-Gesetz – AntiDopG): offences under § 4(4) no. 2(b),

4. under the Asylum Act (Asylgesetz – AsylG):

a) inducement to submit fraudulent applications for asylum under § 84(3),

b) incitement, on a commercial basis or by a gang, to submit fraudulent applications for asylum under § 84a;

5. under the Residence Act (Aufenthaltsgesetz – AufenthG):

a) smuggling of foreigners into the federal territory under § 96(2),

b) smuggling of foreigners into the federal territory resulting in death and smuggling for gain and as an organised gang under § 97,

6. under the Foreign Trade and Payments Act (Außenwirtschaftsgesetz – AWG): intentional offences under §§ 17 and 18;

7. under the Narcotics Act (Betäubungsmittelgesetz – BtMG):

a) offences under one of the provisions referred to in § 29(3) second sentence no. 1, subject to the conditions set out therein,

b) offences under §§ 29a, 30(1) nos. 1, 2 and 4, and §§ 30a and 30b;

8. under the Precursors Control Act (Grundstoffüberwachungsgesetz – GÜG):

offences under § 19(1), subject to the conditions of § 19(3) second sentence;

9. under the War Weapons Control Act (Gesetz über die Kontrolle von Kriegswaffen – KrWaffKontrG):

a) offences under § 19(1) through (3), § 20(1) and (2), and § 20a(1) through (3), each also in conjunction with § 21,

b) offences under § 22a(1) through (3);

9a. under the New Psychoactive Substances Act (Neue-psychoaktive-Stoffe-Gesetz – NPSG):

offences under § 4(3) no. 1(a),

10. under the Code of Crimes against International Law (Völkerstrafgesetzbuch – VStGB):

a) genocide under § 6,

b) crimes against humanity under § 7,

c) war crimes under §§ 8 through 12,

d) crimes of aggression under § 13;

11. under the Weapons Act (Waffengesetz – WaffG):

a) offences under § 51(1) through (3),

b) offences under § 52(1) no. 1 and no. 2(c) and (d), and § 52(5) and (6).

(3) Such order may be made only against the accused or against persons in respect of whom it may be assumed, on the basis of certain facts, that they are receiving or transmitting messages intended for or originating from the accused, or that the accused is using their telephone connection or information technology system.

(4) ¹On the basis of the order for the interception or recording of telecommunications, all those providing or collaborating in the provision of telecommunications services on a commercial basis are required to enable the court, the public prosecution office and its investigators (§ 152 of the Courts Constitution Act (Gerichtsverfassungsgesetz – GVG) to take these measures and to provide the necessary information without delay. ²Whether and to what extent precautionary measures are to be taken in this respect follows from the Telecommunications Act (Telekommunikationsgesetz – TKG) and from the Ordinance on Telecommunications Interception (Telekommunikations-Überwachungsverordnung – TKÜV). ³§ 95(2) applies accordingly.

(5) In the case of measures under subsection (1) second and third sentence, it must be ensured that technical means are in place so that

1. only the following can be intercepted and recorded:

a) ongoing telecommunications (subsection (1) second sentence) or

b) the content and circumstances of the communication which could also have been intercepted and recorded from the date on which the order was made pursuant to § 100e(1) during ongoing transmission processes in the public telecommunications network (subsection (1) third sentence),

2. only such modifications to the information technology system are made as are essential for the collection of the data, and

3. the modifications made are automatically reversed once the measure is concluded, insofar as this is technically possible.

²The means used must provide protection, using methods reflecting the state of the art, against unauthorised access. ³Copied data must be protected, using methods reflecting the state of the art, against modification, unauthorised deletion and unauthorised inspection.

(6) A record is to be made of the following each time technical means are used:

1. the designation of the technical means and the time of its use,

2. information required to identify the information technology system and changes made which are not only transient,

3. information enabling the identification of the data captured and

4. the organisational unit implementing the measure.

§ 100b of the Code of Criminal Procedure – Covert remote searches of information technology systems

(1) Technical means may be used without the knowledge of the affected person to gain covert access to an information technology system used by the affected person and to extract data from that system (‘remote search’) if

1. certain facts give rise to the suspicion that a person has, either as an offender or participant, committed an especially serious crime as referred to in subsection (2) or, in cases where there is criminal liability for attempt, has attempted to commit such an offence,

2. the offence is one of particular severity in the individual case and

3. other means of establishing the facts or determining the accused’s whereabouts would be significantly more difficult or offer no prospect of success.

(2) Particularly serious crimes within the meaning of subsection (1) no. 1 are

1. under the Criminal Code:

a) offences of high treason, endangering the democratic state under the rule of law, treason and endangering external security under §§ 81, 82, 89a, § 89c(1) through (4), under § 94, § 95(3) and § 96(1), in each case also in conjunction with § 97b, and under § 97a, § 98(1) second sentence, § 99(2), § 100 and § 100a(4),

b) forming criminal organisations under § 129(1) in conjunction with § 129(5) third sentence and forming terrorist organisations under § 129a(1), (2), (4), (5) first sentence, first alternative, in each case also in conjunction with § 129b(1),

c) counterfeiting of money and official stamps under §§ 146 and 151, in each case also in conjunction with § 152, and under § 152a(3) and § 152b(1) through (4),

d) crimes against sexual self-determination in the cases under § 176a(2) no. 2 or (3) and, where the conditions of § 177(6) second sentence no. 2 are fulfilled, in the cases under § 177,

e) dissemination, procurement and possession of child pornography in the cases under § 184b (2),

f) murder under specific aggravating circumstances and murder under §§ 211 and 212,

g) offences against personal liberty under § 234, § 234a(1) and (2), §§ 239a and 239b and human trafficking under § 232(3), forced prostitution and forced labour under § 232a(3), (4) or (5) second half-sentence, § 232b (3) or (4) in conjunction with § 232a (4) or (5) second half-sentence and exploitation involving deprivation of liberty under § 233a(3) or (4) second half-sentence,

h) gang theft under § 244(1) no. 2 and aggravated gang theft under § 244a,

i) aggravated robbery and robbery resulting in death under § 250(1) or (2) and § 251,

j) extortion with use of force and threats under § 255 and especially serious cases of extortion under § 253 under the conditions of § 253(4) second sentence,

k) commercial handling of stolen goods, handling of stolen goods as a member of a gang and commercial handling of stolen goods as a member of a gang under §§ 260 and 260a,

l) especially serious cases of money laundering or concealing unlawfully acquired assets under § 261 under the conditions of § 261(4) second sentence; if criminal liability is based on the fact that impunity pursuant to § 261(9) second sentence is ruled out under § 261(9) third sentence, then only where the object of the offence is derived from one of the especially serious crimes referred to in nos. 1 through 7,

m) especially serious cases of taking and giving of bribes under § 335(1) under the conditions of § 335(2) nos. 1 through 3;

2. under the Asylum Act:

a) incitement to submit fraudulent applications for asylum under § 84(3),

b) commercial and organised incitement to submit fraudulent applications for asylum under § 84a(1);

3. under the Residence Act:

a) smuggling of foreigners into the federal territory under § 96(2),

b) smuggling of foreigners into the federal territory resulting in death or smuggling for gain and as an organised gang under § 97;

4. under the Narcotics Act:

a) especially serious cases of offences under § 29(1) first sentence nos. 1, 5, 6, 10, 11 or 13 or §29(3), subject to the conditions of § 29(3) second sentence no. 1,

b) offences under §§ 29a, 30(1) nos. 1, 2 and 4, § 30a,

5. under the War Weapons Control Act:

a) offences under § 19(2) or § 20(1), in each case also in conjunction with § 21,

b) especially serious cases of offences under § 22a(1) in conjunction with § 22a(2);

6. under the Code of Crimes against International Law:

a) genocide under § 6,

b) crimes against humanity under § 7,

c) war crimes under §§ 8 through 12,

d) crimes of aggression under § 13;

7. under the Weapons Act:

a) especially serious cases of offences under § 51(1) in conjunction with § 51(2);

b) especially serious cases of offences under § 52(1) no. 1 in conjunction with § 52(5);

(3) ¹The measure may be directed only against the accused. ²Interference with the information technology systems of other persons is permissible only where it is to be assumed, on the basis of certain facts, that

1. the accused named in the order made pursuant to § 100e(3) uses the other person’s information technology systems and

2. the interference with the accused’s information technology systems alone will not lead to the establishment of the facts or to the determination of the whereabouts of a co-accused.

³The measure may be taken even if it unavoidably affects other persons.

(4) § 100a(5) and (6) applies accordingly, with the exception of § 100a(5) first sentence no. 1.

§ 100d of the Code of Criminal Procedure – Core of private life;
persons entitled to refuse to give evidence

(1) If there are factual indications for assuming that a measure under §§ 100a through 100c will only lead to findings concerning the core of private life, the measure is impermissible.

(2) ¹Findings concerning the core of private life which are made on the basis of a measure under §§ 100a through 100c may not be used. ²Recordings of such findings must be deleted without delay. ³The fact that such findings were made and their deletion are to be documented.

(3) ¹Where possible in the case of measures under § 100b, technical means are to be employed to ensure that data concerning the core of private life are not collected. ²Findings made on the basis of measures under § 100b which concern the core of private life must be deleted without delay or submitted to the court ordering the measure by the public prosecution office for a decision as to their usability and deletion. ³The court’s decision concerning the usability of the data is binding for the further proceedings.

(4) (…)

(5) ¹In the cases under § 53, measures under §§ 100b and 100c are impermissible; if during or after implementation of the measure it becomes apparent that a case under § 53 exists, then subsection (2) applies accordingly. ²In the cases under §§ 52 and 53a, information acquired through measures under §§ 100b and 100c may be used only if, taking into consideration the significance of the underlying relationship of trust, this is not disproportionate to the interest in establishing the facts or determining the whereabouts of an accused person. ³§ 160a(4) applies accordingly.

II. 

3

1. With the Act to Improve the Effectiveness and Practicality of Criminal Proceedings of 17 August 2017, the legislator created a statutory basis for source telecommunications surveillance (§ 100a(1) second and third sentence Code of Criminal Procedure) and remote searches of information technology systems (§ 100b(1) Code of Criminal Procedure) in the Code of Criminal Procedure for the first time. According to the explanatory memorandum to the draft act, the new powers are designed to increase the effectiveness of law enforcement, thus ensuring the proper functioning of the criminal justice system. The legislator argued that the advances in information technology meant that information technology systems (IT systems) have become ubiquitous and their use central to the lives of most people. This applies above all to the use of mobile devices such as smartphones and tablets. According to the legislator, the performance of such devices has increased along with the capacity of their working memories and their storage media, with storage increasingly being handled externally in clouds. The Internet gives users access to a wealth of information and provides many novel communication services. The explanatory memorandum went on to say that traditional forms of remote communication are largely shifting online (cf. Bundestag document, Bundestagsdrucksache – BTDrucks 18/12785, p. 46). Due to their ubiquity, IT systems therefore play an important role in the investigation of crimes.

4

According to the legislator, the existing provision of § 100a of the Code of Criminal Procedure is insufficient. While it provides a statutory basis for collecting communication contents that can be intercepted and recorded during ongoing transmission processes in the public telecommunications network, the investigating authorities can frequently only obtain encrypted data through this channel, given that the majority of communications are now based on Internet Protocol, and numerous Voice over IP and messenger services encrypt the communication contents. The legislator stated that the decryption of such data is either impossible or very time-consuming and costly. Effective law enforcement must address these technical changes and adapt its investigation measures to technological progress (cf. BTDrucks 18/12785, p. 48). In inserting powers to carry out source telecommunications surveillance and remote searches into the Code of Criminal Procedure, the legislator therefore introduced investigation techniques into criminal procedural law that may already be used for public security purposes (cf. Bundestag committee document, Bundestagsausschussdrucksache – BTAusschussdrucks 18<6>334, A). According to the legislator, both measures can be used to access communication ‘at its source’, i.e. before encryption at the sender’s end or after decryption at the recipient’s end, by means of covertly installed software (cf. BTDrucks 18/12785, pp. 48 f.). Remote searches can additionally intercept all contents stored on an IT system and monitor a person’s user behaviour in its entirety (cf. BTDrucks 18/12785, p. 54).

5

2. § 100a(1) second and third sentence and § 100b(1) of the Code of Criminal Procedure permit the covert surveillance of IT systems for law enforcement purposes.

6

a) While traditional telecommunications surveillance (§ 100a(1) first sentence Code of Criminal Procedure) permits the covert interception and recording of telecommunications through the involvement of those providing telecommunications services or collaborating in their provision (see aa) below), source telecommunications surveillance involves accessing the IT system itself. The two challenged powers to carry out source telecommunications surveillance differ regarding the question of whether access to the IT system aims to intercept and record ongoing telecommunication (§ 100a(1) second sentence Code of Criminal Procedure) (see bb) below) or to intercept and record previously conducted telecommunications stored on the system (§ 100a(1) third sentence Code of Criminal Procedure) (see cc) below).

7

aa) § 100a(1) first sentence of the Code of Criminal Procedure permits the covert interception and recording of the telecommunications of affected persons if certain facts give rise to the suspicion that a person has, either as an offender or participant, committed a serious crime listed in § 100a(2) of the Code of Criminal Procedure, has attempted to commit such a crime or has prepared such a crime by committing another crime (cf. § 100a(1) first sentence no. 1 Code of Criminal Procedure). The crime must be of particular severity in the individual case and other means of establishing the facts or determining the whereabouts of the person concerned must be significantly more difficult or futile (§ 100a(1) first sentence nos. 2 and 3 Code of Criminal Procedure). Pursuant to § 100a(3) of the Code of Criminal Procedure, the order may only be directed against the accused or against persons in respect of whom it may be assumed, on the basis of certain facts, that they are receiving or transmitting messages intended for or originating from the accused (so-called intermediaries), or that the accused is using their telephone connection or information technology system (so-called device or connection providers). § 100a(4) of the Code of Criminal Procedure provides that anyone providing or collaborating in the provision of telecommunications services must, on the basis of an order to this effect, enable surveillance measures and provide the required information, i.e. divert the communication contents and meta data under surveillance to the investigating authorities.

8

The provision does not contain any restrictions on the type of telecommunications. According to the statements submitted in the present proceedings ([…]), the service providers obliged to do so will, in practice, divert the entire raw data. This not only includes the contents and meta data of telecommunications between persons, but all data transmitted via the Internet ([…]; regarding the surveillance of telecommunications by the Federal Intelligence Service, Decisions of the Federal Constitutional Court, Entscheidungen des Bundesverfassungsgerichts – BVerfGE 154, 152 <181 para. 10> – Federal Intelligence Service – Foreign surveillance), with a large part of the raw data being practically unreadable due to encryption (cf. Federal Constitutional court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 8 – Trojan I; […]).

9

bb) Source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure authorises the interception and recording of telecommunications through intrusion by technical means into IT systems used by affected persons, subject to the conditions set out in § 100a(1) first sentence and § 100a(3) of the Code of Criminal Procedure. This type of surveillance aims to also capture such communication contents which, due to their encryption, could not be analysed, or could only be analysed with unreasonable effort, if traditional telecommunications surveillance were used. In these instances, the communication may be accessed before communication contents have been encrypted on the transmission device or after they have been decrypted on the receiving device. To this end, the police may use technical means to access the IT system used by the affected person; in particular, the use of surveillance software (so-called trojans) is permitted (cf. BTDrucks 18/12785, pp. 48 f.). However, a system may only be infiltrated if technical measures ensure that only ongoing telecommunications are intercepted and recorded (cf. § 100a(5) first sentence no. 1(a) Code of Criminal Procedure). Infiltrating the system must also be necessary pursuant to §100a(1) second sentence of the Code of Criminal Procedure to enable the interception and recording of telecommunications in unencrypted form. Source telecommunications surveillance, as a subsidiary means, may thus only be ordered if telecommunications are encrypted (cf. also BTDrucks 18/12785, p. 51).

10

§ 100a(5) first sentence nos. 2 and 3 of the Code of Criminal Procedure provide that any modifications to the system must be restricted to what is essential for the collection of data and must be automatically reversed upon termination of the measure, insofar as this is technically possible. § 100a(6) of the Code of Criminal Procedure governs the documentation requirements applicable to any use of technical means. The legislator’s intent was to make the necessary arrangements for ensuring the possibility of ex post review of the measures at issue. This is intended to ensure that the fundamental rights of affected persons are protected effectively and that the collected evidence can be used in court (cf. BTDrucks 18/12785, p. 53). In particular, it serves to allow for an assessment as to whether the software used satisfies the requirements set by § 100a(5) first sentence no. 1(b) of the Code of Criminal Procedure (cf. BTDrucks 18/12785, p. 52). Moreover, the data protection officers of the authority in question and the Federal Data Protection Commissioner have the right to conduct audits within their statutory competences (cf. BTDrucks 18/12785, p. 52).

11

According to the explanatory memorandum to the draft act, the accessing of an IT system through the installation of surveillance software may generally only be carried out by technical means or through the application of cunning and crafty methods by criminal investigators; the power to carry out source telecommunications surveillance does not permit the covert entering of a home to install surveillance software (cf. BTDrucks 18/12785, p. 52).

12

Source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure covers, both technically and legally, the same data as ‘traditional’ telecommunications surveillance, albeit in a readable format, (cf. para. 8) and thus, according to the statements submitted by those entitled to do so and by expert third parties, all incoming and outgoing data from the device under surveillance.

13

cc) By contrast, source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure authorises the interception and recording of communication contents and meta data stored on the IT system of affected persons through intrusion by technical means into the IT system, subject to the conditions set out in § 100a(1) first sentence and § 100a(3) of the Code of Criminal Procedure. The legislator intends this provision to supplement source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure by also allowing access to communication contents and meta data for which the process of transmission has already been concluded and which are still stored on the IT system of the individual targeted by the measure (cf. BTDrucks 18/12785, p. 51). Thus, state access is no longer limited to the direct transmission process, but it must be ensured that only such communication contents and meta data can be put under surveillance which could also have been intercepted in real time after the court order to this effect had been issued (§ 100a(5) first sentence no. 1(b) Code of Criminal Procedure; cf. also BTDrucks 18/12785, pp. 51 f.). By extending source telecommunications surveillance to stored data, the legislator wants to enable investigation authorities to compensate for technical difficulties in implementing source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure, because some time may pass between the order for such surveillance being issued and the start of the surveillance measure. § 100a(1) third sentence of the Code of Criminal Procedure is thus intended to only enable the collection of communication data created up to this point (cf. BTDrucks 18/12785, pp. 51 f.; […]).

14

Source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure therefore only covers communication contents and meta data that have been created after the measure was ordered and are still stored at the time of access (cf. also para. 235). Transitory communication contents that have not been stored, such as the content of phone calls, cannot be captured ([…]).

15

b) Remote searches pursuant to § 100b(1) of the Code of Criminal Procedure permit the infiltration of an IT system used by the affected person and the collection of data from this system if certain facts give rise to the suspicion that a person has, either as an offender or participant, committed a serious crime listed in § 100b(2) of the Code of Criminal Procedure, or attempted to commit such a crime (cf. § 100b(1) no. 1 Code of Criminal Procedure). The crime must be of particular severity in the individual case and other means of establishing the facts or determining the whereabouts of the person concerned must be significantly more difficult or futile (cf. § 100b(1) nos. 2 and 3 Code of Criminal Procedure). An order for a remote search therefore constitutes a subsidiary means; before it is ordered, an assessment is required as to whether an overt search and seizure can be considered (cf. BTDrucks 18/12785, p. 55). Pursuant to § 100b(4) of the Code of Criminal Procedure, § 100a(5) and (6) of the Code of Criminal Procedure apply accordingly, with the exception of § 100a(5) first sentence no. 1 (cf. para. 10).

16

§ 100b(3) of the Code of Criminal Procedure provides that a remote search may, in principle, only be directed against an accused person. Infiltrating IT systems of third parties is only permissible if specific facts give rise to the assumption that an accused person uses their IT systems and the infiltration of the IT system of the accused person alone will not lead to the establishment of the facts or to the determination of the whereabouts of a co-accused. The measure may be carried out even if it unavoidably affects other persons (cf. § 100b(3) third sentence Code of Criminal Procedure).

17

Unlike source telecommunications surveillance, remote searches permit access to the entire IT system. They track the entire user behaviour of an individual, including the contents and meta data of ongoing communications, and provide access to any data stored on the system. The key legislative purpose is the comprehensive monitoring of the use of the system and the reading of its storage media (cf. BTDrucks 18/12785, pp. 47, 54).

18

c) The protection of the core of private life and the protection of relationships of trust, which may give rise to rights to refuse to give evidence, are set out in various provisions.

19

aa) § 100d(1) through (4) of the Code of Criminal Procedure contain requirements for the protection of the core of private life. § 100d(1) of the Code of Criminal Procedure provides that measures pursuant to §§ 100a, 100b of the Code of Criminal Procedure in particular may not be carried out if there are factual indications that such measures will only yield information concerning the core of private life. According to the explanatory memorandum to the draft act, it can be presumed that the data in question exclusively relates to the core of private life in particular if the person under surveillance contacts persons with whom they share a special relationship of trust pertaining to the core of private life – such as close family members, clerics, phone counsellors, defence lawyers or, in some cases, doctors (cf. BTDrucks 18/12785, p. 56). To the extent that investigating authorities can ascertain that such a relationship of trust exists, surveillance measures may not be carried out. By contrast, the mere fact that a measure may also intercept data affecting the core of private life is of no consequence. If information relating to the core of private life is obtained, it may not be used; recordings must be deleted without delay and the fact that such information was obtained and deleted must be documented (cf. § 100d(2) Code of Criminal Procedure).

20

In case of a remote search, § 100d(3) of the Code of Criminal Procedure requires that technical means used during data collection ensure that data concerning the core of private life is not collected. Information relating to the core of private life that is obtained nonetheless must be deleted without delay or submitted to the court that ordered the measure for a decision as to its usability and deletion.

21

bb) The protection of relationships of trust that may give rise to rights to refuse to give evidence (§§ 52 ff. Code of Criminal Procedure) is set out in different parts of the law.

22

The general provisions apply to telecommunications surveillance and source telecommunications surveillance pursuant to § 100a of the Code of Criminal Procedure. For communications between the accused and their defence lawyers, an absolute prohibition to collect data is derived from § 148 of the Code of Criminal Procedure in judicial practice. Information obtained nonetheless may not be used against the accused (cf., e.g., Decisions of the Federal Court of Justice in Criminal Matters, Entscheidungen des Bundesgerichtshofes in Strafsachen – BGHSt 53, 257 <261 f. paras. 13 f.>; […]). While the use of such information against defence lawyers may be conceivable, its permissibility must be examined in the individual case due to the resulting interference with occupational freedom (cf. Federal Constitutional Court, Order of the Second Chamber of the Second Senate of 20 May 2010 - 2 BvR 1413/09 -, paras. 8 ff.). In addition, § 160a of the Code of Criminal Procedure provides for restrictions on the collection and use of data of persons entitled to refuse to give evidence due to their profession and of their assistants; these differentiate according to the specific groups of persons bound by professional confidentiality.

23

Remote searches pursuant to § 100b of the Code of Criminal Procedure are likewise restricted by §§ 148 and 160a of the Code of Criminal Procedure ([…]). Moreover, § 100d(5) first sentence of the Code of Criminal Procedure provides that measures are impermissible when § 53 of the Code of Criminal Procedure provides for a right to refuse to give evidence on professional grounds; thus, remote searches may not target defence lawyers, for example, unless the defence lawyers themselves are suspected of being involved in the crime or a subsequent crime (cf. § 100d(5) third sentence in conjunction with § 160a(4) Code of Criminal Procedure). Information that has nonetheless been obtained from communications with persons bound by professional confidentiality is subject to a comprehensive prohibition to use it (cf. § 100d(5) first sentence, second half-sentence in conjunction with § 100d(2) Code of Criminal Procedure). Finally, in the ‘cases under §§ 52 and 53a’ (family members of the accused, assistants of persons bound by professional confidentiality), § 100d(5) second sentence of the Code of Criminal Procedure provides for a relative prohibition to use the information as evidence that requires a balancing of interests.

24

d) § 100e(1) first sentence of the Code of Criminal Procedure provides that measures pursuant to § 100a of the Code of Criminal Procedure are subject to a requirement of prior judicial authorisation. The judicial order must be limited to a maximum duration of three months, and may be extended by no more than three months at a time (cf. § 100e(1) fourth and fifth sentence Code of Criminal Procedure). A remote search pursuant to § 100b of the Code of Criminal Procedure may only be ordered by a division of the Regional Court as listed in § 74a(4) of the Courts Constitution Act and must be limited to a maximum duration of one month; it may be extended by one month at a time, but after the order has been extended to a total six months, any further extension may only be ordered by the Higher Regional Court (cf. § 100e(2) Code of Criminal Procedure).

25

3. The legislator has amended §§ 100a and 100b of the Code of Criminal Procedure several times since August 2017. The amendments only concern the catalogues of criminal offences in § 100a(2) and § 100b(2) of the Code of Criminal Procedure. §§ 100d and 100e of the Code of Criminal Procedure have not been amended.

III. 

26

The complainants challenge the powers to carry out source telecommunications surveillance and remote searches (§ 100a(1) second and third sentence, § 100b(1) Code of Criminal Procedure), including the supplementary provisions in § 100a(3) through (6), § 100b(2) through (4) and § 100d(1) through (3) and § 100d(5) of the Code of Criminal Procedure. They assert a violation of Art. 1(1), Art. 2(1) in conjunction with Art. 1(1) (guarantee of the confidentiality and integrity of information technology systems), Art. 10(1), Art. 13(1) and Art. 19(4) of the Basic Law (Grundgesetz – GG).

27-61

[...]

IV. 

62

Statements in the constitutional complaint proceedings were submitted by the Federal Court of Justice (Bundesgerichtshof), the (then) Federal Commissioner for Data Protection and Freedom of Information, the Federal Public Prosecutor General (Generalbundesanwalt) of the Federal Court of Justice, the Association of German Criminal Police Officers (Bund Deutscher Kriminalbeamter e.V.), the Chaos Computer Club e.V., the German Police Union within the Civil Servants’ Association (Deutsche Polizeigewerkschaft im DBB), the German Bar Association (Deutscher Anwaltverein e.V.), the German Federation of Journalists (Deutscher Journalisten-Verband e.V.), the German Association of Judges (Deutscher Richterbund e.V.), the Society for Civil Rights (Gesellschaft für Freiheitsrechte e.V.) and the Union of the German Police (Gewerkschaft der Polizei).

63

The additional questionnaire regarding the use of cloud services, the significance of findings obtained through measures pursuant to § 100a(1) of the Code of Criminal Procedure for law enforcement and regarding practical experience with the implementation of source telecommunications surveillance was answered by the Federal Government, several Land governments, the data protection authorities of the Federation and the Länder, the Federal Public Prosecutor General, the Federal Statistical Office (Statistisches Bundesamt), the Chaos Computer Club, the Society for Data Protection and Data Security (Gesellschaft für Datenschutz und Datensicherheit e.V.) and the Society for Civil Rights.

64-102

[...]

B. 

103

Parts of the constitutional complaint, which was lodged in due time on 7 August 2018, are inadmissible. The complainants do not have a recognised legal interest in lodging a constitutional complaint with respect to § 100b(2) no. 1(l) of the Code of Criminal Procedure in the challenged version (see I. below). Complainant no. 3) did not lodge his constitutional complaint in due form (see II. below). The remaining complainants, who are affected to varying degrees, have only demonstrated in part that their fundamental rights may have been violated (see III. below). For the rest, the constitutional complaint satisfies the subsidiarity requirements (see IV. below). To the extent that the constitutional complaint is admissible (see V. below), the Federal Constitutional Court has jurisdiction (see VI. below).

I. 

104

The complainants do not have a recognised legal interest in lodging a constitutional complaint with respect to § 100b(2) no. 1(l) of the Code of Criminal Procedure in the challenged version. The provision was amended after the constitutional complaint was lodged by the Act to Improve the Criminal Law Response to Money Laundering (Gesetz zur Verbesserung der strafrechtlichen Bekämpfung der Geldwäsche) of 9 March 2021 (BGBl I p. 327) with effect from 18 March 2021 (cf. now § 100b(2) no. 1(m) Code of Criminal Procedure).

II. 

105

[…]

III. 

106

The other complainants only have standing in part.

107

Pursuant to Art. 94(1) no. 4a of the Basic Law and § 90(1) of the Federal Constitutional Court Act (Bundesverfassungsgerichtsgesetz – BVerfGG), a constitutional complaint can only be admissible if complainants assert that their fundamental rights – or rights equivalent to fundamental rights – have been violated by an act of public authority (cf. BVerfGE 140, 42 <54 para. 47>). They must demonstrate, in accordance with the substantiation requirements under § 23(1) second sentence and § 92 of the Federal Constitutional Court Act, that a violation of fundamental rights appears possible and that they are individually, directly and presently affected. If a constitutional complaint is directed against legislation that authorises security authorities to carry out covert surveillance measures, special admissibility prerequisites apply in this regard (for more details BVerfGE 165, 1 <30 ff. paras. 39 ff.> – Police powers under the Security and Public Order Act for Mecklenburg-Western Pomerania; established case-law).

108

1. Based on these standards, the complainants have not shown that a duty of protection arising from fundamental rights, in particular from the fundamental right protecting IT systems (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) may have been violated. The complainants have failed to demonstrate, as is constitutionally required (cf. in this regard BVerfGE 158, 170 <191 f. para. 51> – IT security vulnerabilities), that the legislative design may fall short in consideration of the legislative context. In this regard, they have failed to consider the criminal procedural law, data protection law and cyber security law applicable to the protection of IT systems (cf. also Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 53; Order of the Second Chamber of the First Senate of 17 April 2023 - 1 BvR 176/23 inter alia -, para. 6).

109

2. The complainants have demonstrated in part that the challenged provisions may violate the fundamental right protecting IT systems in its dimension as a defensive right against state interference as well as Art. 10(1) of the Basic Law.

110

The complainants have demonstrated that the powers to carry out source telecommunications surveillance pursuant to § 100a(1) second and third sentence of the Code of Criminal Procedure may violate the fundamental right protecting IT systems, and, with regard to § 100a(1) second sentence of the Code of Criminal Procedure, also Art. 10(1) of the Basic Law, insofar as the statutory powers – in view of their severity of interference – permit the prosecution of criminal offences that are not sufficiently serious (see a) below). They have also shown that the power to carry out remote searches in § 100b(1) of the Code of Criminal Procedure may be unconstitutional as a result of its interference with the fundamental right protecting IT systems and with Art. 10(1) of the Basic Law, given that the requirement that affected fundamental rights be expressly specified (Zitiergebot) may not be satisfied with regard to Art. 10(1) of the Basic Law and that the protection of the core of private life may be inadequate with regard to both fundamental rights (see b) below).

111

a) The complainants have demonstrated that fundamental rights may have been violated insofar as they assert that the criminal offences listed in § 100a(2) of the Code of Criminal Procedure that may be used as grounds for source telecommunications surveillance pursuant to § 100a(1) second and third sentence of the Code of Criminal Procedure are not sufficiently serious. For the rest, their submissions challenging § 100a(1) second and third sentence in conjunction with § 100a(3) through (6), § 100d(1), (2) and (5) of the Code of Criminal Procedure do not satisfy the substantiation requirements.

112

aa) The complainants have demonstrated that source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure may result in interference with both the fundamental right protecting IT systems and with Art. 10(1) of the Basic Law.

113

With regard to § 100a(1) third sentence of the Code of Criminal Procedure, by contrast, the complainants have only shown a possible interference with the fundamental right protecting IT systems, but not with the privacy of telecommunications under Art. 10(1) of the Basic Law. Art. 10(1) of the Basic Law only protects against the specific risks associated with remote communication, since such communication requires a technical transmission process which is not controlled by those affected alone; therefore, it is particularly vulnerable to the risk of others obtaining knowledge thereof (cf. BVerfGE 115, 166 <182, 186>; in more detail Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 87 f. with further references). The protection provided by Art. 10(1) of the Basic Law does not extend to the contents and meta data of communication outside of an ongoing communication process, i.e., after the transmission has been completed, which is stored in the domain controlled by affected persons (cf. BVerfGE 115, 166 <183 f.>; 120, 274 <307 f.>; 124, 43 <54>). Based on this standard, the complainants have not shown that the permission in § 100a(1) third sentence of the Code of Criminal Procedure to intercept and record the contents and meta data of previous communications stored on the IT system of affected persons may curtail the guarantee of Art. 10(1) of the Basic Law. They have failed to address the facts that the transmission process which is protected by the fundamental right has already been completed and that the data is controlled by the affected persons.

114-152

[...]

153

3. In contending that § 100b of the Code of Criminal Procedure may violate Art. 13(1) of the Basic Law, the complainants have not satisfied the substantiation requirements. They have not even demonstrated that there may be an interference with the fundamental right to the inviolability of the home.

154

a) Insofar as the complainants claim that the challenged provision gives rise to interference with the inviolability of the home protected by Art. 13(1) of the Basic Law on the grounds that investigating authorities can independently control cameras and microphones through the infiltrated IT system, and can thus actively generate data, they have failed to substantiate that § 100b(1) of the Code of Criminal Procedure even permits such use. Yet such substantiation would have been necessary. Based on its wording alone, § 100b(1) of the Code of Criminal Procedure only permits the collection of data from the system itself (‘to extract data from that system’), which argues against the notion that the IT system may be used to generate data. The corresponding view held in legal scholarship is that § 100b(1) of the Code of Criminal Procedure does not authorise the separate making of video or audio recordings of circumstances outside the IT system ([…]). This is also supported by the fact that the legislator defined the measure as a ‘remote search’ (cf. § 100b(1) of the Code of Criminal Procedure), and that a search is limited to existing content, and thus to content created by the target person found by the investigating authorities. Finally, the complainants have not discussed the fact that an interference with Art. 13(1) of the Basic Law is of such severity that it would give rise to special justification requirements and require specific statutory powers for this reason alone (cf. BVerfGE 165, 363 <389 ff. paras. 54, 66 ff., 77> – Automated data analysis).

155

b) [...]

156

4. The challenge concerning Art. 19(4) of the Basic Law is also inadmissible. […]

157

5. Complainants nos. 1), 2), 4) and 5) have demonstrated to differing degrees that they are affected.

158

According to the case-law of the Federal Constitutional Court, special prerequisites apply for demonstrating that complainants are individually, directly and presently affected when a constitutional complaint is directed against statutory powers to carry out covert surveillance measures (cf. in more detail BVerfGE 165, 1 <31 f. paras. 41 ff.>).

159

a) The complainants are directly affected by §§ 100a and 100b of the Code of Criminal Procedure within the meaning of constitutional procedural law. The provisions give rise to covert investigation measures. The notification requirements provided for in § 101(4) first sentence nos. 3 and 4 of the Code of Criminal Procedure only counter their covert nature in part, because § 101(4) first sentence no. 4, third through fifth sentence, § 101(5) and (6) third sentence of the Code of Criminal Procedure restrict or completely dispense with them. The assertion of a right to information under § 491(2) of the Code of Criminal Procedure in conjunction with § 57(1) first sentence of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), too, is subject to far-reaching restrictions pursuant to § 57(4) in conjunction with § 56(2) of the Federal Data Protection Act. If such information was provided, it would only be of limited value as a result of these restrictions and could not provide reliable proof of whether the complainants are affected by a measure under §§ 100a and 100b of the Code of Criminal Procedure (cf. in this regard BVerfGE 162, 1 <56 f. para. 107>).

160

b) The complainants had to provide detailed reasons for their assertion that they may be individually and presently affected, because the indiscriminate effects of the challenged measures pursuant to §§ 100a and 100b of the Code of Criminal Procedure are limited by the law and the circumstances (see aa) below). They have ultimately done so to differing degrees (see bb) below).

161

aa) The indiscriminate effects of measures pursuant to §§ 100a and 100b of the Code of Criminal Procedure are limited. In respect of target persons placed under surveillance, they are considerably restricted by specific thresholds for interference and the required seriousness of the listed criminal offences. In addition, compliance with the prerequisites for interference is ensured by the requirement of prior judicial authorisation, which, in the case of remote searches, even requires an order of a Regional Court division consisting of three professional judges (§ 100e(1) first sentence, § 100e(2) first sentence Code of Criminal Procedure). By contrast, the assertion that the complainants are affected as third parties may be subject to lower burdens of substantiation. With regard to third parties, the indiscriminate effects of the challenged powers are not restricted to the same extent, given that persons who merely maintain electronic communications with potential target persons – without being themselves directly linked to the criminal act under investigation – can be affected by surveillance (cf. BVerfGE 113, 348 <383>; Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 74 with further references).

162-163

bb) [...]

IV. 

164

Insofar as the complainants have standing, they have satisfied the subsidiarity requirements for the constitutional complaint. Based on the applicable constitutional standards (in this regard Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 78 f. with further references), no prior review by the ordinary courts is required. The admissibility of legal remedies in the ordinary courts notwithstanding, this case raises specifically constitutional questions, and no improved basis for decision-making can be expected from a prior examination carried out by the ordinary courts.

V. 

165

Ultimately, the constitutional complaint is admissible insofar as it is directed against § 100a(1) second and third sentence in conjunction with § 100a(1) first sentence no. 2 and § 100a(2) of the Code of Criminal Procedure and challenges the inadequate seriousness of the criminal offences required for the measures in question. For the rest, it is inadmissible, also in view of the supplementary provisions in § 100a(3) through (6) of the Code of Criminal Procedure; with regard to § 100a(4) of the Code of Criminal Procedure, no relevant submissions have been made.

166

The constitutional complaint directed against § 100b(1) of the Code of Criminal Procedure is admissible to the extent that it challenges a violation of the requirement that affected fundamental rights be expressly specified (Art. 19(1) second sentence of the Basic Law) and the inadequate protection of the core of private life due to the fact that the circumstances under which such measures must be discontinued are not specified. Insofar as it challenges § 100b(2) through (4) of the Code of Criminal Procedure, the constitutional complaint is inadmissible.

167

The challenges to the supplementary provisions in § 100d(1) through (3) and § 100d(5) of the Code of Criminal Procedure are likewise inadmissible. Insofar as they are directly challenged, this also follows from the fact that the provisions themselves merely contain restrictions to protect the core of private life and that only § 100a(1) second and third sentence and § 100b(1) of the Code of Criminal Procedure authorise intrusive interferences (cf. BVerfGE 169, 130 <161 para. 58, 165 para. 68>).

VI. 

168

The Federal Constitutional Court has jurisdiction to review the compatibility of the challenged provisions with the fundamental rights of the Basic Law, even though these provisions are related to data protection provisions in legal acts of the European Union, such as the Law Enforcement Directive 2016/680/EU. The provisions do not implement binding EU law, given that legal acts of the European Union do not contain any provisions that require the repressive surveillance powers at issue, let alone provide an exhaustive legal framework; the challenged powers are not fully determined by EU law. This does not affect the question of whether additional legal requirements arise directly from secondary EU law and whether the challenged provisions are compatible with those legal requirements (cf. Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 83 with further references).

C. 

169

To the extent that it is admissible, the constitutional complaint is well-founded for the most part.

170

The challenged powers authorise the investigating authorities to covertly collect personal data for law enforcement purposes by making use of technical means to infiltrate IT systems used by affected persons. They thus give rise to interference with the general right of personality following from Art. 2(1) in conjunction with Art. 1(1) of the Basic Law in its manifestation as the fundamental right protecting the confidentiality and integrity of information technology systems (fundamental right protecting IT systems) and in its manifestation as the right to informational self-determination, as well as with the privacy of telecommunications protected by Art. 10(1) of the Basic Law. These interferences only satisfy the constitutional justification requirements in part.

I. 

171

The interferences with both the fundamental right protecting IT systems and Art. 10(1) of the Basic Law resulting from source telecommunications surveillance under § 100a(1) second sentence of the Code of Criminal Procedure (see 1. below) cannot be justified insofar as the criminal offences set out as prerequisites for interference in § 100a(1) second sentence in conjunction with § 100a(1) first sentence no. 1 and § 100a(2) of the Code of Criminal Procedure are not sufficiently serious (see 2. below). Insofar as only an interference with Art. 10(1) of the Basic Law is at issue, § 100a(1) second sentence of the Code of Criminal Procedure does not raise constitutional concerns (see 3. below).

172

1. The power to carry out source telecommunications surveillance under § 100a(1) second sentence of the Code of Criminal Procedure gives rise to interference with the fundamental right protecting the confidentiality and integrity of information technology systems (fundamental right protecting IT systems) and with the privacy of telecommunications protected by Art. 10(1) of the Basic Law.

173

As a manifestation of the general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law), the fundamental right protecting IT systems protects against any infiltration of IT systems. It protects IT systems that are used by affected persons as their own [with an expectation of exclusivity] and may contain, by themselves or due to network connections, personal data of those users in such volume and variety that access to the system grants insights into essential aspects of their personal life or even allows for the creation of a comprehensive personality profile. The fundamental right safeguards the confidentiality and integrity of protected IT systems (in more detail BVerfGE 120, 274 <313 ff.>; Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 97 ff. with further references – Trojan I). By contrast, the privacy of telecommunications (Art. 10(1) of the Basic Law) protects the intangible transmission of information by way of telecommunications technology against the specific risks arising from remote communication. This also includes access to a user device in order to obtain communication-related data (in more detail Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 87 with further references).

174

The power to carry out source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure authorises the interception and recording of ongoing telecommunications, including through intrusion by technical means into IT systems used by affected persons. This gives rise to interference with both the fundamental right protecting IT system and the privacy of telecommunications protected by Art. 10(1) of the Basic Law. § 100a(1) second sentence of the Code of Criminal Procedure must be reviewed on the basis of both fundamental rights (cf. regarding § 20c(1) in conjunction with § 20c(2) of the North Rhine-Westphalia Police Act, Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 85 ff., 105 ff. with further references).

175

By contrast, a measure only results in interference with Art. 10(1) of the Basic Law if a person is affected by a surveillance measure pursuant to § 100a(1) second sentence of the Code of Criminal Procedure, but this surveillance measure is not based on the infiltration of a sufficiently qualified IT system used as their own (cf. para. 173). In this respect, the fundamental right protecting IT systems does not afford protection (cf. BVerfGE 120, 274 <315>; […]). Thus, it does not protect third parties who are only affected by source telecommunications surveillance because they are in contact with the person whose IT system is under surveillance. Likewise, the infiltration, pursuant to § 100a(3) of the Code of Criminal Procedure, of an IT system used as their own by intermediaries only results in interference with the fundamental right protecting IT systems of such intermediaries, but not of the accused, too. However, the protection afforded by the privacy of telecommunications, which is the only fundamental right affected in such cases, cannot be more comprehensive than the protection that would be afforded if both the fundamental right protecting IT systems and the privacy of telecommunications were affected at the same time (cf. in this regard BVerfGE 109, 279 <326>; in more detail para. 218).

176

2. The interferences with both the fundamental right protecting IT systems and Art. 10(1) of the Basic Law resulting from the infiltration of IT systems which are used by affected persons as their own are not justified insofar as source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure in conjunction with § 100a(1) first sentence no. 1 and § 100a(2) of the Code of Criminal Procedure is also permitted for the investigation of crimes which carry a maximum penalty of three years imprisonment or less and therefore fall into the category of low-level crime.

177

a) The constitutionality of covert surveillance powers depends on the fundamental rights affected in each case and, above all, on the requirements derived from the principle of proportionality (cf. Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 123 ff. with further references). No special treatment is accorded to interferences with the fundamental right protecting IT systems, which is subject to the three limitations set out in Art. 2(1) of the Basic Law and can be restricted for both preventive and repressive purposes (cf. BVerfGE 120, 274 <315>), nor to interferences with Art. 10(1) of the Basic Law (cf. BVerfGE 100, 313 <373 ff.>; 113, 348 <385 ff.>). Surveillance powers must pursue a legitimate purpose, and must be suitable, necessary and proportionate in the strict sense for achieving that purpose (cf. BVerfGE 141, 220 <265 para. 93> with further references). The requirements of proportionality in the strict sense in particular give rise to decisive limitations. How stringent these requirements are in each case depends on the severity of interference and the weight of the public interest (cf. BVerfGE 141, 220 <269 para. 105>).

178

The constitutional requirements apply to the threshold for interference and – for repressive measures – to the severity of the criminal offences that serve as grounds for the surveillance measures. The threshold for interference requires a reliable factual basis both for establishing a suspicion of criminal conduct and for extending the surveillance measure to third parties (cf. BVerfGE 129, 208 <242>). In addition, for measures that serve law enforcement purposes and are therefore repressive in nature, the severity of the relevant criminal offence is the key factor. The legislator has divided such criminal offences into different categories – considerable, serious and particularly serious criminal offences – and has defined each category in greater detail (cf. BVerfGE 141, 220 <270 para. 107>). The severity of the interference is decisive for determining how serious the prosecuted offence must be (cf. BVerfGE 141, 220 <269 ff. paras. 104 ff.>; 169, 130 <172 paras. 87 f.>; 170, 247 <275, para. 74>; in more detail paras. 201 ff.). That said, the respective prerequisites for interference are not determined independently of one another. Rather, an overall assessment is required regarding the combination of the seriousness of the crime at issue and the strength of the suspicion, in consideration of the severity of the interference with fundamental rights in particular (cf. BVerfGE 109, 279 <351>; cf. also BVerfGE 165, 1 <86 paras. 161, 90 f. para. 173>; 170, 247 <275 ff. paras. 75 ff.>).

179

b) Based on these standards, parts of the challenged provision in § 100a(1) second sentence of the Code of Criminal Procedure do not satisfy the requirements of proportionality in the strict sense with regard to the necessary severity of the criminal offence at issue.

180

aa) Yet § 100a(1) second sentence of the Code of Criminal Procedure serves a legitimate purpose (see (1) below) and is suitable and necessary for achieving that purpose (see (2) below).

181

(1) The challenged power to carry out source telecommunications surveillance serves to provide the investigating authorities with means of investigation which enable them to more effectively prosecute criminal offences that at least fall into the category of serious offences. It is designed to enable the authorities to conduct surveillance of telecommunications in cases where such telecommunications are encrypted – as is increasingly the case (cf. also paras. 4 and 8) – and readable content data can therefore no longer be obtained through traditional telecommunications surveillance pursuant to § 100(1) first sentence of the Code of Criminal Procedure (see para. 8). Putting in place effective surveillance measures is a legitimate purpose (cf. BVerfGE 129, 208 <241 f.>; cf. also BVerfGE 133, 277 <321 para. 106; 333 f. para. 133>; 169, 332 <374 para. 101>). It increases the efficiency of law enforcement (cf. BVerfGE 115, 166 <192>), which is accorded great importance under the Basic Law (cf. BVerfGE 100, 313 <388>; 113, 29 <54>), including in light of the constitutional obligation of the state to guarantee the proper functioning of the criminal justice system (cf. BVerfGE 122, 248 <272 f.>; 130, 1 <26>).

182

(2) § 100a(1) second sentence of the Code of Criminal Procedure is suitable and necessary under constitutional law to achieve this aim. It provides police authorities with means for investigation that can contribute to the more effective prosecution of crimes. It is not ascertainable that there are less restrictive means that could provide equally far-reaching investigative possibilities. At the same time, source telecommunications surveillance may only be ordered if it is suitable and necessary in each individual case (cf. § 100a(1) first sentence no. 3 of the Code of Criminal Procedure, cf. also BVerfGE 141, 220 <266 f. para. 97>).

183

bb) However, § 100a(1) second sentence of the Code of Criminal Procedure is not fully compatible with the particular requirements derived from proportionality in the strict sense that apply to covert surveillance measures. The power permits very serious interferences with fundamental rights (see (1) below). The strict requirements for their justification regarding the necessary seriousness of the criminal offences to be investigated (see (2) below) are not fulfilled by at least some of the criminal offences listed in § 100a(2) of the Code of Criminal Procedure (see (3) below) .

184

(1) § 100a (1) second sentence of the Code of Criminal Procedure permits very serious interferences with fundamental rights.

185

(a) The severity of interference resulting from data collection powers primarily depends on the type, scope and possible uses of the data as well as on risks of it being abused (cf. BVerfGE 65, 1 <45 f.>; 109, 279 <353 f.> with further references). Relevant criteria include, in particular, the number of persons affected and the severity of the impairments (cf. BVerfGE 100, 313 <376>), which primarily depends on the informative value and the possibilities of using the data, i.e. on the disadvantages that fundamental rights holders may face or have reason to fear as a result of the further use of the collected data (cf. BVerfGE 162, 1 <76 para. 157> with further references). In general, the covert nature of state measures also considerably increases the severity of interference (BVerfGE 155, 119 <178 f. para. 129> with further references – Subscriber data II). The severity of interference is also affected by the duration of a surveillance measure, because the longer it goes on, the more serious the interference with the general right of personality becomes (cf. BVerfGE 141, 220 <293 para. 171>; 162, 1 <92 para. 191>). Moreover, the severity of the interference resulting from a measure depends on the extent of possible insights into one’s personality, on whether particularly private information can be obtained, and on whether legitimate expectations of confidentiality are breached (cf. BVerfGE 141, 220 <269 para. 105>; 155, 119 <229 para. 253>; 170, 247 <281 f. para. 93>; established case-law). The severity of interference is also influenced by the manner in which data is collected (cf. in this regard BVerfGE 165, 363 <404 para. 90>). It increases the severity of interference if the data collection in itself can result in particular burdens or risks for those affected or for third parties (cf. BVerfGE 120, 274 <325>; […]).

186

(b) Based on these standards, the interference with both fundamental rights resulting from § 100a(1) second sentence of the Code of Criminal Procedure is very serious.

187

(aa) The manner and scope of the collected data as such intensify the interference with fundamental rights as source telecommunications surveillance grants investigating authorities access to data which, in terms of their volume and variety, may by far exceed traditional sources of information.

188

Based on an assessment in substantive terms of the legal and factual possibilities of use permitted by § 100a(1) second sentence and § 100a(5) first sentence no. 1 of the Code of Criminal Procedure, which is the relevant assessment here (cf. BVerfGE 162, 1 <147 para. 326>; 165, 363 <429 para. 149>), the interception and recording of ongoing telecommunications permitted by the power at issue includes capturing the entire raw data. Unlike with traditional telecommunications surveillance pursuant to § 100a(1) first sentence of the Code of Criminal Procedure (cf. para. 8), this raw data can be fully analysed despite being potentially encrypted; all parts of the captured raw data obtained through a measure pursuant to § 100a(1) second sentence of the Code of Criminal Procedure can be read by the investigating authorities ([…]). The power under § 100a(1) second sentence of the Code of Criminal Procedure thus has an exceptional reach, particularly given the realities of modern information technology and its significance for communication relations. The data that can be intercepted carries a vast variety of types of electronic communication, which can then be analysed. Moreover, given the ubiquitous and diverse uses of IT systems, all forms of activity of individuals and of human communication are increasingly reflected in electronic signals and thus become accessible through source telecommunications surveillance. Thus, surveillance covers communications reaching deep into everyday life, including highly private and spontaneous communications and stored images and files. Ultimately, all data transmitted via the Internet is subject to surveillance, including, for example, users’ online behaviour and the interests, wishes and preferences expressed thereby (cf. also BVerfGE 154, 152 <243 para. 151>). According to the statements submitted by the parties entitled to do so ([…]) and the expert third parties heard in the proceedings ([…]), this includes all data shared with online services for data storage or use of software services (cloud services and software as a service). This not only concerns large amounts of data in various formats (such as voice, text, image and video files). This data may also include detailed information on the personal circumstances and private life of affected persons, their private and business correspondence via various communication channels, or even diary-like personal notes; all aspects of life – including private and highly private ones – may be affected (cf. BVerfGE 120, 274 <323>; cf. also Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 113 with further references). For example, login data to online services such as cloud services, online banking or health services (cf. BVerfGE 120, 274 <324>) and data from fitness trackers may be read. If a cloud backup is run on the IT system under surveillance during the period specified in the surveillance order, all data initially only stored on the IT system (including previous communication data stored there) may potentially be intercepted as telecommunications, depending on the manufacturer’s or user’s default settings.

189

In light of today’s user habits, IT systems are typically also used to deliberately store personal data that is particularly sensitive, for example private text documents, images or sound files (cf. BVerfGE 120, 274 <322 f.>). They are now used in all aspects of life and play an essential role in the lives of the majority of people (cf. Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 113 with further references; cf. also Constitutional Court of Austria, Decision of 14 December 2023 - G 352/2021-46 -, paras. 37, 66 ff.; CJEU, Judgment of 4 October 2024, Bezirkshauptmannschaft Landeck, C-548/21, EU:C:2024:830, paras. 93 f.). It is increasingly common for many people and businesses to use cloud services, including cloud storage ([…]). The industry association Bitkom estimates, based on a business survey, that around 81% of all companies were using cloud services in 2024, with an additional 14% planning to do so or discussing it ([…]). Similar figures were obtained by the Federal Statistical Office for 2023 ([…]) and the KPMG Cloud Monitor for 2024. When it comes to private use of cloud services, no comparably reliable data is available. However, the parties entitled to submit statements and the expert third parties agreed that a large and increasing share of the population uses cloud services simply as a result of the default settings of commonly used smartphones and the software installed on them ([…]).

190

(bb) In light of the increased analytical capacities, which are very extensive today (cf. in this regard BVerfGE 154, 152 <243 para. 151>), state access to such comprehensive data records entails the obvious risk that, in an overall assessment, the collected data allows comprehensive conclusions to be drawn regarding the private life of affected persons, with far-reaching insights into their personality, which may even include the creation of behaviour and communication profiles (cf. in this regard BVerfGE 120, 274 <323>). Given that this data is often highly personal, especially when it is combined with all other available data, the interference with the affected fundamental rights is of particular severity (cf. regarding remote searches BVerfGE 141, 220 <304 para. 210>).

191

(cc) To the extent that the collected data provides information on communications with third parties, the severity of interference is aggravated further. Such data collection measures indiscriminately affect a considerable number of persons, which increases the severity of interference, regardless of whether the statutory grounds for such data access are also met in relation to these third parties (cf. BVerfGE 120, 274 <323>).

192

(dd) It also increases the severity of interference that source telecommunications surveillance, in addition to being a covert measure, deliberately circumvents security mechanisms such as the use of encryption technology when the system is accessed. The fact that affected persons are prevented from protecting themselves and their information increases the severity of the interference with fundamental rights (cf. in this regard BVerfGE 120, 274 <324 f.>). Moreover, the accessing of an IT system frustrates legitimate expectations of the integrity and confidentiality of the system. This is associated with great potential risks. Once the IT system has been infiltrated, the critical technical step has been taken that enables spying, monitoring or manipulation in relation to this system (cf. also BVerfGE 120, 274 <314>).

193

(ee) The severity of interference is further increased by possible risks to the integrity of the accessed IT system and to legal interests of the persons concerned and of a large and unspecified number of third parties.

194

The accessing of the system in itself gives rise to the risk of compromising its functionalities. It must be noted in this regard that read-only access does not exist, at least when it comes to the infiltration of an IT system through surveillance software. Investigating authorities and any third parties entrusted with such infiltration can, accidentally or through deliberate manipulation, delete or modify data or create new data (cf. BVerfGE 120, 274 <325>). The indirect risks resulting from the accessing of an IT system must also be taken into account. Investigating authorities may use surveillance software to access a target system by exploiting unknown IT security vulnerabilities (so-called zero-day exploits). It affects the severity of interference that the powers at issue, by virtue of their very existence, present investigating authorities with an incentive to keep open any security vulnerabilities that come to their attention so as to exploit such vulnerabilities for infiltration purposes (cf. BVerfGE 120, 274 <326>; 158, 170 <188 f. para. 42>; 162, 1 <142 para. 316>; […]). As a consequence, there is a risk that investigating authorities will refrain from suggesting that the vulnerability be closed, or even actively work towards ensuring that the vulnerability remains undetected (BVerfGE 120, 274 <326>).

195

(ff) It increases the severity of interference that § 100a(1) second sentence of the Code of Criminal Procedure not only permits one-off and isolated data collection measures, but longer-term surveillance of telecommunications, including the entire communication conducted online (cf. also BVerfGE 120, 274 <324>). That said, it mitigates the severity of interference that the measure is subject to a time limit. § 100e(1) fourth sentence of the Code of Criminal Procedure provides that a court order permitting the measure be limited to a maximum of three months. While such an order can in effect be renewed indefinitely, renewal is only possible for the same maximum period [of three months] and requires a separate judicial order each time (cf. § 100e(1) fifth sentence Code of Criminal Procedure; cf. also BVerfGE 165, 1 <49 para. 88>). There is also a legal obligation to terminate the measure without delay if the conditions on which the order was based are no longer met (cf. § 100e(5) Code of Criminal Procedure).

196

(gg) In an overall assessment, source telecommunications surveillance results in very serious interference with both Art. 10(1) of the Basic Law and the fundamental right protecting IT systems.

197

This is based on the consideration that any covert surveillance of telecommunications in principle amounts to a serious interference with at least the privacy of telecommunications, because such surveillance encroaches on communications that are often private and possibly even highly confidential in nature (cf. BVerfGE 129, 208 <240>; 154, 152 <241 para. 147>; 170, 79 <133, para. 157>).

198

Although all variants of telecommunications surveillance under § 100a(1) of the Code of Criminal Procedure ultimately serve to intercept communications data, source telecommunications surveillance pursuant to § 100(1) second sentence of the Code of Criminal Procedure considerably increases the severity of interference due to the type and scope of usable data (paras. 187 ff.), in particular compared to traditional telecommunications surveillance (cf. paras. 8 and 188). Surveillance measures pursuant to § 100a(1) second sentence of the Code of Criminal Procedure can concern volumes of data that are much greater and more informative [than that obtained through traditional telecommunications surveillance]. This is further aggravated by the fact that, in using source telecommunications surveillance, investigating authorities do not just exploit a vulnerable moment in remote communications, but also circumvent security mechanisms, and thus not only compromise the integrity of IT systems, but also jeopardise their confidentiality.

199

Nevertheless, the restriction of the measures at issue to ongoing telecommunications mitigates the severity of interference – especially in comparison to remote searches pursuant to § 100b of the Code of Criminal Procedure – because the data created, processed and stored within or accessible through the system can at least not be fully intercepted. Firstly, it depends on user behaviour if and to what extent data that is typically stored locally (videos, images, text files) can be subject to surveillance as ongoing telecommunications, for example due to a cloud backup. How much information a surveillance measure yields therefore cannot be predicted in detail (cf. in this regard BVerfGE 154, 152 <241 para. 148>). Moreover, compared to remote searches, affected persons have greater influence on the scope of data access, as they can, for example, minimise their use of Internet-based communication services. Secondly, § 100a(1) second sentence of the Code of Criminal Procedure does not permit real-time surveillance of the entire IT system in such a way that, for example, all processing steps involved in creating a text can be recorded. Access to ongoing telecommunications through source telecommunications surveillance therefore cannot be equated with full access to an IT system ([…]).

200

Nevertheless, given the realities of modern IT systems use, source telecommunications surveillance – in itself, but especially in comparison to traditional telecommunications surveillance – ultimately results in very serious interference with both the fundamental right protecting IT systems and Art. 10(1) of the Basic Law (for a different assessment BVerfGE 141, 220 <310 para. 229, 312 para. 237>).

201

(2) Because of the very high severity of interference resulting from source telecommunications surveillance as permitted by § 100a(1) second sentence of the Code of Criminal Procedure , such surveillance must be limited to the prosecution of particularly serious criminal offences in accordance with the principle of proportionality in the strict sense.

202

(a) Very serious interferences are only proportionate in the strict sense if the interests they serve to protect are sufficiently weighty. The weight of the interest in criminal prosecution depends, in particular, on the seriousness and significance of the crime to be investigated (cf. BVerfGE 100, 313 <375 f., 392>; 107, 299 <321>). Thus, the severity of interference of the measure in question is decisive for answering the question of whether the criminal offences provided for by the legislator meet the requirements regarding their seriousness prescribed by constitutional law. But it must also be taken into account whether and to what extent the legislator has otherwise limited the prerequisites for interference. Only such an overall assessment can reveal whether the legislator was within its margin of appreciation when assigning a certain category of criminal offences (considerable, serious, particularly serious) to a measure.

203

(b) Based thereon, source telecommunications surveillance as set out in § 100a(1) second sentence of the Code of Criminal Procedure must serve to prosecute particularly serious crimes. Otherwise the very serious interferences with the fundamental right protecting IT systems and with Art. 10(1) of the Basic Law would not be appropriately limited in substantive terms.

204

With measures that serve law enforcement purposes, the severity of the criminal offence targeted by the measure is the key factor. The legislator has divided such criminal offences into different categories – considerable, serious and particularly serious criminal offences (cf. BVerfGE 169, 130 <218 para. 202>; cf. also BVerfGE 141, 220 <270 para. 107> with further references; 162, 1 <118 para. 251>). For instance, the acoustic surveillance of private homes requires the suspicion of a particularly serious crime (cf. Art. 13(3) of the Basic Law; BVerfGE 109, 279 <343 ff.>), telecommunications surveillance requires the suspicion of a serious crime (cf. BVerfGE 125, 260 <328 f.>; 129, 208 <243>), while observation by means of a GPS tracker, for example, requires the suspicion of a considerable crime (cf. BVerfGE 107, 299 <321 f.>; 112, 304 <315 f.>; 141, 220 <270 para. 107>). An additional fourth category is the authorisation to carry out measures to investigate any crime.

205

Because of the great severity of interference resulting from source telecommunications surveillance as permitted by § 100a(1) second sentence of the Code of Criminal Procedure, such surveillance requires a restriction to the prosecution of particularly serious criminal offences within the meaning of constitutional law. In this regard, even an overall assessment of the prerequisites for interference does not warrant lowering the necessary seriousness of the criminal offences to be prosecuted. While the requirement of a sufficiently serious initial suspicion in § 100a(1) second sentence in conjunction with § 100a(1) first sentence no. 1 of the Code of Criminal Procedure (cf. para. 7) does not raise constitutional concerns in itself, it does not constitute a particularly strong threshold for interference. The reservation of subsidiarity, which provides that other means of criminal prosecution must be significantly more difficult or futile (cf. § 100a(1) first sentence no. 3 Code of Criminal Procedure; see para. 7), too, does restrict the measure, but its effect should not be overestimated due to its broadness.

206

That a particularly serious criminal offence is required as grounds for interference also cannot be changed by the fact that the legislator has envisaged source telecommunications surveillance as a functional equivalent to traditional telecommunications surveillance pursuant to § 100a(1) first sentence of the Code of Criminal Procedure in order to reflect the development that ongoing communications are increasingly encrypted (cf. BTDrucks 18/12785, pp. 50 ff.; cf. paras. 4, 8 above). The legislator wanted to rule out the collection of data that is processed or stored on the infiltrated system, but is not part of ongoing communications during the surveillance period ([…]). However, due to the type and scope of the data that can be collected through a measure pursuant to § 100(1) second sentence of the Code of Criminal Procedure in particular (cf. paras. 188 f.) and due to the breaches of the integrity and risks to confidentiality entailed by the infiltration of an IT system, such a measure is no longer comparable to traditional telecommunications surveillance.

207

(c) The required seriousness of the criminal offences that may serve as grounds for such surveillance must be set out by the legislator (see (aa) below). The investigating authorities and bodies involved in independent oversight (cf. BVerfGE 141, 220 <275 f. paras. 117 f.>) must examine whether a crime is of sufficient seriousness in the individual case (see (bb) below).

208

(aa) If a power relating to law enforcement requires the suspicion, based on specific facts, of a criminal offence of a certain seriousness, this requires further specification. The legislator itself must determine which criminal offences are covered by the power. In this respect, it is afforded a margin of appreciation. The legislator may either refer to existing statutory catalogues of offences or draw up a new catalogue, for example to include criminal offences which are of particular relevance for the measure in question (cf. BVerfGE 125, 260 <328 f.>; 154, 152 <269 para. 221>). However, the classification of the relevant criminal offence as serious or particularly serious must be objectively reflected in the criminal law provision itself (cf. BVerfGE 109, 279 <343 ff.>; 125, 260 <329>; 169, 130 <220 para. 206>), in particular by its sentencing range and, where applicable, by the criteria for commission of the offence and its consequences laid down in its constituent elements or statutory aggravating factors (cf. BVerfGE 109, 279 <344>; 169, 130 <220 para. 206>). The legislator is not limited to constituent elements that must be classified as felonies (Verbrechen) within the meaning of § 12 of the Criminal Code. The inclusion of misdemeanours (Vergehen) in the catalogue of criminal offences is also permissible if the elements of the crime fulfil the criterion of particularly serious criminal offence (cf. BVerfGE 109, 279 <345>; 169, 130 <220 para. 207>). If other maximum penalties apply to unspecified serious or less serious cases, the basic constituent elements of an offence apply (cf. BVerfGE 109, 279 <349>). A blanket clause or abstract references to particularly serious criminal offences are not sufficient (cf. BVerfGE 125, 260 <329>).

209

Based on the sentencing range of a criminal provision, a criminal offence can generally be classified as particularly serious if it carries a maximum penalty of more than five years imprisonment (cf. BVerfGE 109, 279 <347 f., 349>; 165, 1 <93 para. 179>; 169, 130 <219 para 203>). The way the statutory sentencing system is set up, offences with a maximum penalty of more than five years imprisonment immediately carry a maximum penalty of ten years imprisonment or more. Such a maximum penalty only applies to offences that represent particularly serious transgressions and thus clearly fall outside the scope of medium-level crime (cf. BVerfGE 109, 279 <348>).

210

By contrast, a maximum penalty of at least five years imprisonment does not automatically mean that a criminal offence is serious (cf. BVerfGE 129, 208 <243>; 141, 220 <338 para. 316>) or particularly serious, because this also encompasses criminal offences carrying a maximum penalty of five years imprisonment, which can at most be classified as medium-level crime (cf. BVerfGE 109, 279 <348>; 124, 43 <64>; 129, 208 <243>); these include mass crime such as common theft, public defamation or simple bodily harm (cf. BVerfGE 141, 220 <338 para. 316>). That said, the particular severity of the criminal offence is not determined by the sentencing range alone (cf. BVerfGE 109, 279 <344>). Therefore, a criminal offence that carries a maximum penalty of at least five years imprisonment can be classified as a particularly serious criminal offence if this appears justified not only with regard to the protected legal interests and their importance to society, but also with regard to the way in which the criminal act was committed and its consequences (cf. BVerfGE 169, 130 <219 f. para. 205>).

211

If a criminal act carries a maximum penalty of no more than three years imprisonment or a fine, it falls into the category of low-level crime, which precludes its classification as a particularly serious criminal offence from the outset (cf. BVerfGE 169, 130 <221 para. 208>).

212

(bb) In addition to the abstract definition of a catalogue of criminal offences, the legislator must also ensure that specific facts give rise to the suspicion that the offence has the necessary seriousness in each individual case (cf. BVerfGE 125, 260 <329> with further references). In light of the diversity of life, it is conceivable that there may be cases in which someone’s conduct meets the constituent elements, viewed in abstract terms, of a particularly serious or a serious criminal offence, without this conduct being so transgressive as to be capable of justifying the implementation of intrusive covert surveillance measures.

213

(3) Consequently, the interferences with fundamental rights resulting from § 100a(1) second sentence of the Code of Criminal Procedure are not justified insofar as § 100a(1) second sentence in conjunction with § 100a(1) first sentence no. 1, § 100a(2) of the Code of Criminal Procedure permits source telecommunications surveillance to investigate criminal offences which carry a maximum penalty of three years imprisonment or less and therefore only fall into the category of low-level crime.

214

(a) It is irrelevant in this respect that the legislator itself only requires what it designates as a ‘serious criminal offence’ in § 100a(1) first sentence no. 1 of the Code of Criminal Procedure, that it conclusively defines such ‘serious criminal offences’ in § 100a(2) of the Code of Criminal Procedure and that it merely requires in § 100a(1) first sentence no. 2 of the Code of Criminal Procedure that the offence must be ‘serious’ in the individual case. This is because only the substantive legal content of the criminal offences set out in the provision – both in abstract and specific terms – is decisive in this respect.

215

(b) Based on the necessary restriction to the prosecution of particularly serious criminal offences, at least those criminal offences listed in § 100a(2) of the Code of Criminal Procedure that carry a maximum penalty of three years imprisonment or less and thus fall into the category of low-level crime do not satisfy the constitutional requirements. These offences are not particularly serious from the outset, which is why they are not capable of justifying a measure as intrusive as source telecommunications surveillance. Insofar as they have been admissibly challenged, this concerns the following offences listed in § 100a(2) no. 1(a), (c), (d) and (t), no. 6 and no. 7(b) of the Code of Criminal Procedure in the challenged version of 17 August 2017 (BGBl I p. 3202): § 85(2) of the Criminal Code, § 86(1) and (2) of the Criminal Code, § 97(2) of the Criminal Code, § 97b(1) first sentence in conjunction with § 97(2) of the Criminal Code, § 109g(1) in conjunction with § 109g(4) first sentence of the Criminal Code, § 109g(2) of the Criminal Code, § 129(1) second sentence of the Criminal Code, § 129(1) second sentence in conjunction with § 129b of the Criminal Code, § 130(2), (4) and (5) of the Criminal Code, § 310(1) no. 4 in conjunction with § 309(6) of the Criminal Code, § 313(2) in conjunction with § 308(6) of the Criminal Code, § 17(5) of the Foreign Trade and Payments Act, § 18(5a) of the Foreign Trade and Payments Act, § 30b of the Narcotic Drugs Act in conjunction with § 129(1) second sentence of the Criminal Code, § 30b of the Narcotic Drugs Act in conjunction with § 129(1) second sentence in conjunction with § 129b of the Criminal Code.

216

In the context of law enforcement, unlike in public security law, it is not possible to additionally consider the legal interests at stake for criminal offences that fall into the category of low-level crime; even if a criminal act qualified as, for example, a terrorist offence in the individual case, this would be irrelevant (cf. in this regard Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 138). When it comes to repressive law enforcement measures, the only relevant factor is the seriousness of the criminal offences to be prosecuted, which – in addition to a sufficient threshold for interference – triggers the criminal prosecution interest of the state and thereby justifies repressive investigation measures. Even according to the legislator’s assessment, criminal offences that carry a maximum penalty of no more than three years imprisonment are generally not based on transgressions that could justify their classification as particularly serious.

217

Insofar as some of the offences listed in § 100a(2) of the Code of Criminal Procedure carry a maximum penalty of five years imprisonment and thus at most fall into the category of medium-level crime, they are not particularly serious criminal offences from the outset (cf. para. 210). However, since the complainants have not challenged individual offences in this regard (para. 120), these do not form part of the subject of review. All other offences listed in § 100a(2) of the Code of Criminal Procedure are offences that carry a maximum penalty of more than five years imprisonment, which therefore fall into the category of particularly serious criminal offences (cf. para. 209).

218

3. In contrast, insofar as the power to carry out source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure interferes with Art. 10(1) of the Basic Law only, because the person concerned does not use the affected IT system as their own and the fundamental right protecting IT systems is therefore not affected (cf. paras. 173 and 175), the interference is justified. The severity of interference resulting from surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure in such cases is nowhere near that resulting from a measure directed against an IT system used by a person as their own, especially with regard to the type and scope of data (cf. paras. 187ff.) and the type and manner of data collection (paras. 193f.), but is rather comparable to [traditional] telecommunications surveillance pursuant to § 100a(1) first sentence of the Code of Criminal Procedure. In such cases, it is therefore sufficient under the principle of proportionality that the power pursuant to § 100a(1) second sentence in conjunction with § 100a(1) first sentence no. 1, § 100a(2) of the Code of Criminal Procedure is restricted to the prosecution of ‘serious criminal offences’. There is no need to address the question of whether all offences listed in § 100a(2) of the Code of Criminal Procedure meet the requirements regarding their seriousness prescribed by constitutional law, because this has not been challenged by the complainants.

II. 

219

The interference with the fundamental right protecting IT systems resulting from § 100a(1) third sentence of the Code of Criminal Procedure is likewise not justified insofar as § 100a(1) third sentence in conjunction with § 100a(1) first sentence no. 1, (2) of the Code of Criminal Procedure also permits source telecommunications surveillance to investigate criminal offences which carry a maximum penalty of no more than three years imprisonment and therefore fall into the category of low-level crime.

220

1. The power to carry out source telecommunications surveillance under § 100a(1) third sentence of the Code of Criminal Procedure also gives rise to interference with the fundamental right protecting IT systems insofar as an IT system used by a person as their own is accessed (see a) below). While § 100a(1) third sentence of the Code of Criminal Procedure also affects the scope of protection of the right to informational self-determination (see b) below), this right yields [to the fundamental right protecting IT systems] in the present case (see c) below).

221

a) Source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure interferes with the fundamental right protecting IT systems ([…]) since investigating authorities may use technical means to access IT systems in order to potentially make use of their capacities, functions and stored contents. The provision permits access to IT systems in their entirety. It is irrelevant in this respect that interception and recording pursuant to § 100a(1) third sentence and § 100a(5) first sentence no. 1(b) of the Code of Criminal Procedure is restricted to ongoing telecommunications which took place between the time the measure was ordered and its commencing. This restriction in terms of subject matter and time does not alter the fact that the potential risks directly arising from infiltration through the use of technical means concern the entire expectation of confidentiality regarding the IT system. Once an intrusion into the system has occurred, the confidentiality of all data created, processed and stored within or accessible through the system is at considerable risk (cf. also Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 103). By contrast, no interference with the fundamental right protecting IT systems can be found if the IT system is not used by a person as their own or is not sufficiently qualified (cf. BVerfGE 120, 274 <315>; in more detail paras. 173 and 175).

222

b) Yet § 100a(1) third sentence of the Code of Criminal Procedure also affects the scope of protection of the right to informational self-determination.

223

aa) As a manifestation of the general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law), the right to informational self-determination confers upon the individual the authority to, in principle, decide themselves when and to what extent they wish to disclose personal matters (cf. BVerfGE 65, 1 <42>; 115, 320 <341>; 150, 1 <106 para. 219>). The protection concerns the self-determination of the individual over their personal data (cf. BVerfGE 115, 320 <341 f.>) Thus, the right to informational self-determination affords protection against the unlimited collection, storage, use or sharing of personal data (cf. BVerfGE 65, 1 <43>; 115, 166 <188>; 115, 320 <341>; 120, 274 <312>; 169, 332 <364 para. 81>). This protection, which relates to specific processes, is solely procedural in nature, which means that it does not depend on how significantly the data affects someone’s personality. The protection depends neither on the quality or sensitivity of the data (cf. BVerfGE 65, 1 <45>; 120, 378 <398>) nor on the storage location ([…]). The quantity of data is also irrelevant. Rather, the right to informational self-determination is affected whenever personal data is collected, stored, used or shared. Therefore, it not only protects against individual instances of data collection, but also against access to large, and thus typically highly informative, datasets ([…]). Insofar as the view put forward in its [Remote searches] judgment of 27 February 2008 (BVerfGE 120, 274 <313>) might deviate from these considerations, the Senate now departs from its previous case-law. This is because the right to informational self-determination not only protects individual pieces of data. Rather, it protects precisely against comprehensive risks to one’s personality arising from (modern) information technology and the combination of individual pieces of data from different sources (cf. in this regard BVerfGE 65, 1 <42>; 165, 363 <388 f. para. 50, 394 paras. 65, 396 ff. paras. 69 f.>). Therefore, the fundamental right protects not only against the collection of data that can be attributed to individuals, but also against access to comprehensive data sets (cf. regarding the seizure of the entire data kept by a of a law firm BVerfGE 113, 29 <45 f.>). This is not changed by the fact that the collection of an especially great volume of data gives rise to particularly serious interference. Otherwise, there would be reason to fear that no specific fundamental rights protection would be afforded against access to large volumes of data which are highly informative, in particular when neither the fundamental right protecting IT systems nor Art. 10(1) of the Basic Law are affected.

224

bb) Therefore, § 100a(1) third sentence of the Code of Criminal Procedure also affects the scope of protection of the right to informational self-determination. The provision permits the collection of data stemming from communication processes which are stored on an IT system after their conclusion – and thus outside the scope of protection of Art. 10(1) of the Basic Law (cf. in this regard Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 88 with further references; cf. also para. 113).

225

c) However, the right to informational self-determination yields to the fundamental right protecting IT systems in the present case.

226

aa) In its Remote searches judgment from 2008 – the foundational decision for the fundamental right protecting IT systems – the Federal Constitutional Court ultimately did not define the relationship between the two fundamental rights. The fundamental right protecting IT systems as applied to remote searches was developed as a necessary additional manifestation of the general right of personality in light of new risks to the free development and exercise of one’s personality. Yet this does not mean that this right will take precedence if other fundamental rights are affected (regarding the relationship between the fundamental right protecting IT systems and Art. 10(1) of the Basic Law cf. Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 108 f.; […]).

227

bb) If a provision authorises the collection of data from an IT system infiltrated through technical means, the right to informational self-determination is superseded by the fundamental right protecting IT systems. Of these two manifestations of the general right of personality, the fundamental right protecting IT systems offers more specific protection than the right to informational self-determination, with the former right focusing on the breach of the integrity of IT systems used by affected persons as their own and the risks to the confidentiality of such systems resulting from state access to them ([…]). Where data is collected in this way, the protection afforded by the fundamental right protecting IT systems takes precedence.

228

Both fundamental rights serve to protect freedom of conduct and privacy and thus address risks to one’s personality arising from state access to personal data. However, the formal basis of the fundamental right protecting IT systems is a specific protected subject matter. It is tied to the protected space of an IT system used by a person as their own, while the right to informational self-determination provides general protection against access to personal data, both within and outside the digital sphere and on any IT system or in cyberspace, regardless of who owns affected IT systems (regarding the fundamental right to the inviolability of the home cf. BVerfGE 51, 97 <105>; 109, 279 <325 f.>; 113, 29 <45>; 118, 168 <184>; regarding possible exceptions cf. BVerfGE 115, 166 <187 f.>). The fundamental right protecting IT systems not only protects the confidentiality of data breached during data collection processes, but shifts this protection to an earlier stage. Its scope of protection includes abstract expectations of confidentiality regarding an IT system before specific data collection processes occur (cf. Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 100 f.), which serves to provide anticipatory protection of one’s personality.

229

The specific risks created by access to an IT system alone are characteristic for the protection afforded by the fundamental right [protecting IT systems]; its scope of protection encompasses the potential risks relating to the system as a whole (cf. Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, para. 100). The fundamental right protecting IT systems therefore protects the system as a category and for its own sake, independent of the actual collection of personal data, emphasising the risks to the right of personality and therefore making the threshold for interference especially clear.

230

cc) If both fundamental rights are affected, the fundamental right protecting IT systems is therefore lex specialis. Yet even where IT systems are accessed, there is still scope for applying the right to informational self-determination. The right to informational self-determination can serve as the sole standard of review when the collection of data from an infiltrated IT system is not protected by the fundamental right protecting IT systems, for example because an IT system is not sufficiently qualified or is not used by a person as their own (cf. para. 173; […]). In case of source telecommunications surveillance pursuant to § 100a(1) third sentence of the Basic Law, which merely permits access to stored data, this concerns, for example, communication data of third parties stored on the IT system, since such data is not protected by Art. 10(1) of the Basic Law as the more specific guarantee. In this respect, however, the protection afforded by the right to informational self-determination cannot be more extensive than the protection afforded by the fundamental right protecting IT systems (cf. also in this regard BVerfGE 109, 279 <326>; in more detail para. 239).

231

2. The interference with the fundamental right protecting IT systems resulting from access to an IT system used by a person as their own is likewise not justified insofar as § 100a(1) third sentence in conjunction with § 100a(1) first sentence no. 1, § 100a(2) of the Code of Criminal Procedure also permits source telecommunications surveillance to investigate criminal offences which carry a maximum penalty of three years imprisonment or less and therefore fall into the category of low-level crime.

232

§ 100a(1) third sentence of the Code of Criminal Procedure does not satisfy the special requirements for the justification of covert surveillance measures arising from the principle of proportionality in the strict sense (see paras. 177ff.). Measured against the severity of interference (see a) below), the required seriousness of the criminal offences to be investigated with the measures permitted by § 100a(1) third sentence in conjunction with § 100a(1) first sentence no. 1, § 100a(2) of the Code of Criminal Procedure does not satisfy the constitutional requirements in all respects (see b) below).

233

a) Source telecommunications surveillance pursuant to 100a(1) third sentence of the Code of Criminal Procedure is also very serious, although its severity is slightly lower than that of measures pursuant to § 100a(1) second sentence of the Code of Criminal Procedure.

234

With regard to source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure, the severity of interference, which is primarily determined by the type, scope and possible use of collected data and risks of abuse, but also by the way the data is collected as such (see para. 185), is similar to the severity resulting from source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure. As a result of technological developments and the changed use of IT systems, even measures pursuant to § 100a(1) third sentence of the Code of Criminal Procedure in principle permit the interception of data that, in terms of its type and scope, allows far-reaching conclusions to be drawn that affect the personality rights of affected persons (cf. paras. 187 ff.).

235

That said, it mitigates the severity of interference that § 100a(1) third sentence of the Code of Criminal Procedure does not permit general access to stored data. For these cases, § 100a(5) first sentence no. 1(b) of the Code of Criminal Procedure permits only the interception of the contents and meta data of communications that have occurred from the time when the order pursuant to § 100e(1) of the Code of Criminal Procedure was issued and are (still) stored on the IT system. In this respect, the relevant point in time is determined by the order for source telecommunications surveillance ([…]), rather than by an order previously issued in the same investigation pursuant to § 100a(1) first sentence and § 100e(1) of the Code of Criminal Procedure, which would permit retrospective data collection over a potentially very long period. Thus, the collection of data that was stored before the court ordered source telecommunications surveillance is ruled out (cf. BTDrucks 18/12785, p. 52). However, it must be taken into account that large quantities of sensitive personal data can accumulate even in short periods of time. Yet since source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure, at least according to the legislative concept (cf. BTDrucks 18/12785, p. 51), is intended to only be ordered in addition to a measure pursuant to § 100a(1) second sentence of the Code of Criminal Procedure, it only covers the communications data that has been stored on the IT system in the period between the issuing of the order and access in the form of activation of the surveillance software (cf. regarding § 11(1a) second sentence Article 10 Act, Gesetz zur Beschränkung des Brief‑, Post- und Fernmeldegeheimnisses, Artikel 10-Gesetz – G 10, Decisions of the Federal Administrative Court, Entscheidungen des Bundesverwaltungsgerichts – BVerwGE 177, 327 <332 para. 14>). According to the statements submitted by the parties entitled to do so in the present proceedings, source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure will typically only be conducted for several days or weeks (see paras. 67 and 81).

236

The severity of interference is further mitigated by the fact that § 100a(1) third sentence of the Code of Criminal Procedure does not include ongoing telecommunications, which are protected by the privacy of telecommunications. It merely permits the interception and recording of stored contents and meta data of previous telecommunications conducted primarily via messenger services (cf. BTDrucks 18/12785, pp. 50 f.; […]). Unlike in the case of § 100(1) second sentence of the Code of Criminal Procedure, it is technically impossible to intercept ‘transitory’ communications data, such as contents of voice or video telephony, insofar as no recordings are permanently or temporarily stored on affected IT systems. According to the Society for Data Protection and Data Security ([…]), which was heard as an expert third party in the present proceedings, data traffic with cloud services can only be captured insofar as it is still available in the form of local synchronisation data (e.g. local temporary copies and temporarily stored data).

237

Ultimately, however, the infiltration of the system through source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure has a clear aggravating effect on the severity of interference (cf. paras. 193 f.). This infiltration is the key aspect distinguishing the measure from traditional telecommunications surveillance pursuant to § 100a(1) first sentence of the Code of Criminal Procedure and means that it is, in terms of its severity of interference, closer overall to source telecommunications surveillance pursuant to § 100a(1) second sentence of the Code of Criminal Procedure. Compared to traditional telecommunications surveillance, the infiltration of the IT system ultimately entails greater potential risks, given that surveillance software can, and must, structurally access the entire storage of the IT system to find and filter the stored communications data.

238

b) Based on these considerations, source telecommunications surveillance as set out in § 100a(1) third sentence of the Code of Criminal Procedure must also, in view of its severity of interference, serve to prosecute particularly serious criminal offences. Otherwise, the very serious interference with the fundamental right protecting IT systems would not be appropriately limited in substantive terms. At least the offences listed in § 100a(2) no. 1(a), (c), (d) and (t), § 100a(2) no. 6 and no. 7(b) of the Code of Criminal Procedure in the challenged version of 17 August 2017 (BGBl I p. 3202), which carry a maximum penalty of three years imprisonment or less, do not satisfy these requirements (cf. para. 215).

239

3. Insofar as the power to carry out source telecommunications surveillance does not give rise to interference with the fundamental right protecting IT systems (cf. para. 230), and must therefore be measured against the right to informational self-determination, the interference is justified. The severity of interference resulting from surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure in these cases is nowhere near that resulting from a measure directed against an IT system used by a person as their own (cf. para. 218). In those cases it is therefore sufficient under the principle of proportionality that interferences based on § 100a(1) third sentence in conjunction with § 100a(1) first sentence no. 1, § 100a(2) of the Code of Criminal Procedure are limited to the prosecution of ‘serious criminal offences’. In this case, too, there is no need to address the question of whether all offences listed in § 100a(2) of the Code of Criminal Procedure meet the requirements regarding their seriousness prescribed by constitutional law, because this has not been challenged by the complainants.

III. 

240

§ 100b(1) of the Code of Criminal Procedure violates Art. 10(1) in conjunction with Art. 19(1) second sentence of the Basic Law (see 1. below), because the legislator did not observe the requirement that affected fundamental rights be expressly specified (see 2. below). By contrast, the absence of a statutory obligation to discontinue remote searches undertaken in real time violates neither the fundamental right protecting IT systems nor the right to informational self-determination (see 3. below).

241

1. If the IT system that is accessed is used by those affected as their own, the power to conduct remote searches pursuant to § 100b(1) of the Code of Criminal Procedure permits interference with both the fundamental right protecting IT systems and Art. 10(1) of the Basic Law. When both fundamental rights are affected, the power to conduct remote searches must be reviewed on the basis of both fundamental rights.

242

§ 100b(1) of the Code of Criminal Procedure authorises the covert infiltration, by technical means, of an IT system used by the targeted individual and the collection of data from this system (remote searches of IT systems). Any data created, processed and stored within or accessible through the system can be collected, which allows for the tracking of the entire user behaviour (cf. BTDrucks 18/12785, pp. 47, 54). The provision thus permits interference with the general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law) in its manifestation as the fundamental right protecting the confidentiality and integrity of information technology systems (fundamental right protecting IT systems) (cf. also BVerfGE 120, 274 <302>; 141, 220 <303 para. 209>; 162, 1 <139 f. paras. 307 f.>; 165, 1 <69 para. 128>), insofar as the system is used by the affected person as their own (cf. BVerfGE 120, 274 <315>).

243

In addition, the provision gives rise to interference with Art. 10(1) of the Basic Law, given that § 100b(1) of the Code of Criminal Procedure also permits the surveillance of ongoing telecommunications conducted using an IT system (generally BVerfGE 120, 274 <307>; cf. also BVerfGE 158, 170 <184 para. 28>). Where both fundamental rights are affected, they are applied in parallel (Idealkonkurrenz) (cf. Federal Constitutional Court, Order of the First Senate of 24 June 2025 - 1 BvR 2466/19 -, paras. 105 ff. with further references). This also applies with regard to remote searches (the relationship between the two fundamental rights was expressly left open in BVerfGE 120, 274 <340> and not specifically addressed in BVerfGE 141, 220 <303 para. 209>; 165, 1 <69 para. 128>; the present decision provides clarification to what was held in BVerfGE 162, 1 <140 para. 308>).

244

If, by contrast, the IT system under surveillance is not used by the target person as their own – such as when data of unavoidably affected third parties is collected (cf. § 100b(3) third sentence Code of Criminal Procedure) – or if the fundamental right protecting IT systems is not affected for other reasons (cf. para. 173; cf. BVerfGE 120, 274 <314 f.>), persons affected by data collection measures can invoke Art. 10(1) of the Basic Law insofar as the measures target ongoing telecommunications, or the right to informational self-determination insofar as only stored data is collected (cf. regarding homes not used by the target person as their own BVerfGE 109, 279 <326>; with regard to remote searches, the aforementioned constellations have clearly not been considered so far, cf. BVerfGE 141, 220 <303 para. 209>; 165, 1 <69 para. 128>; cf. also regarding the review of powers that are from the outset limited to IT systems used by the target person as their own BVerfGE 162, 1 <139 f. paras. 307 f.> and for the rest para. 243).

245

2. For formal reasons alone, § 100b(1) of the Code of Criminal Procedure is incompatible with the Constitution. Insofar as the provision (also) grants powers to interfere with Art. 10(1) of the Basic Law, it does not satisfy the requirement that affected fundamental rights be expressly specified, laid down in Art. 19(1) second sentence of the Basic Law.

246

a) Art. 19(1) second sentence of the Basic Law requires that a law state the fundamental right that is restricted or can be restricted by it, specifying the relevant article. This requirement that affected fundamental rights be expressly specified applies to fundamental rights that may be restricted by the legislator on the basis of an express authorisation to do so provided by the fundamental right itself (cf. BVerfGE 64, 72 <79 f.>; 113, 348 <366>; 129, 208 <236>). It serves as a warning and encourages reflection (cf. BVerfGE 113, 348 <366>; 120, 274 <343>). In requiring that the interference be specified in the wording of the law, it is meant to ensure that the legislator is aware of any interferences with fundamental rights resulting from its legislation and that the decision is made in awareness of the effects on the affected fundamental rights (cf. BVerfGE 85, 386 <404>; 113, 348 <366>; 129, 208 <236 f.>). In light of this, fundamental rights that are indirectly restricted without their restriction being the intention of the law need not be specified. This is because extending the requirement that affected fundamental rights be expressly specified to such restrictions would typically result in the precautionary listing of a number of potentially affected fundamental rights, which would diminish its function to serve as a warning and encourage reflection (cf. BVerfGE 170, 293 <334 f. para. 97> with further references).

247

The legislator violates the requirement that affected fundamental rights be expressly specified precisely when it considers these fundamental rights to be unaffected based on a certain interpretation of their scope of protection and therefore does not set them out in the law as being restricted. In these cases, the legislator is not aware that it is authorising interferences with fundamental rights and is not aware of their effects (cf. BVerfGE 154, 152 <237 para. 135>). Moreover, the legislator thus evades a public debate, which would serve to clarify the necessity and scale of interferences with fundamental rights (cf. BVerfGE 85, 386 <403 f.>; 113, 348 <366>; 129, 208 <236 f.>; 154, 152 <237 para. 135>). Therefore, the requirement that affected fundamental rights be expressly specified is only satisfied if the restriction of the fundamental right is expressly set out in the wording of the law in question or in the amending act introducing this law; a statement to this effect in the explanatory memorandum is not sufficient (cf., e.g., BVerfGE 113, 348 <367>). The legislator’s awareness that it is interfering with fundamental rights must be reflected in the wording of the law (cf. BVerfGE 120, 274 <343>).

248

b) In light of the foregoing, § 100b(1) of the Code of Criminal Procedure, which also authorises interferences with Art. 10(1) of the Basic Law, does not satisfy the requirement that affected fundamental rights be expressly specified following from Art. 19(1) second sentence of the Basic Law (for remote searches pursuant to § 5(2) no. 11 of the North Rhine-Westphalia Protection of the Constitution Act, former version, this was left open in BVerfGE 120, 274 <340>).

249

aa) Under Art. 10(2) first sentence of the Basic Law, the fundamental right to the privacy of telecommunications is subject to an express limitation clause. The requirement that affected fundamental rights be expressly specified therefore also applies to restrictions of Art. 10(1) of the Basic Law (cf. BVerfGE 113, 348 <366>; 154, 152 <236 para. 134>; […]). It is irrelevant in this respect whether other fundamental rights in addition to Art. 10(1) of the Basic Law are affected (cf. regarding Art. 2(2) first sentence and Art. 12(1) of the Basic Law, BVerfGE 161, 299 <348 paras. 121 f., 403 para. 255>). Art. 19(1) second sentence of the Basic Law therefore also applies insofar as the fundamental right protecting IT systems is applicable (cf. paras. 242) in addition to Art. 10(1) of the Basic Law (cf. in this respect paras. 244f.).

250

b) § 100b(1) of the Code of Criminal Procedure does not satisfy the requirement that affected fundamental rights be expressly specified. Even though the power also permits interference with the privacy of telecommunications protected by Art. 10(1) of the Basic Law (cf. paras. 242), neither the Code of Criminal Procedure nor the Act inserting § 100b into the Code of Criminal Procedure specify that Art. 10(1) of the Basic Law is restricted by § 100b of the Code of Criminal Procedure. The Act to Improve the Effectiveness and Practicality of Criminal Proceedings of 17 August 2017 (BGBl I p. 3202), which introduced the repressive power to carry out remote searches pursuant to § 100b of the Code of Criminal Procedure for the first time, merely specifies Art. 10(1) of the Basic Law in its Art. 17 with regard to amendments to § 100a of the Code of Criminal Procedure.

251

cc) There is no scope for an interpretation in conformity with the Constitution which could render § 100b of the Code of Criminal Procedure constitutional. In principle, such an interpretation may need to be given precedence over a finding of unconstitutionality (cf. BVerfGE 130, 151 <204>). However, this requires that the flawed provision can be interpreted in such a way that it does not restrict the fundamental right which was not specified in violation of Art. 19(1) second sentence of the Basic Law. An interpretation of § 100b of the Code of Criminal Procedure according to which the provision does not result in interference with Art. 10(1) of the Basic Law, and thus does not authorise the surveillance of telecommunications conducted via the Internet in particular, is not possible. Such an interpretation would conflict with the clearly ascertainable intent of the legislator (cf. in this regard BVerfGE 128, 157 <179>; 162, 1 <171 para. 387>). In the legislative materials, the legislator unequivocally stated that remote searches of IT systems should serve to monitor the entire user behaviour of a person ( BTDrucks 18/12785, pp. 47, 54).

252

3. By contrast, § 100b(1) of the Code of Criminal Procedure – insofar as it was admissibly challenged – satisfies the constitutional requirements for the protection of the core of private life following from the affected fundamental rights in conjunction with Art. 1(1) of the Basic Law, which already apply during the data collection stage when it comes to particularly intrusive, covert surveillance measures like in the case at hand. In particular, the legislator does not have to provide for an obligation to discontinue such surveillance measures if it becomes ascertainable that they encroach upon the core of private life, notwithstanding the fact that such measures may have to be discontinued in the individual case (regarding the application of surveillance powers without a high risk of violations of the core of private life, cf. para. 255).

253

It is true that the constitutional requirements regarding sufficient protection of the core of private life for intrusive measures may, in principle, require a statutory obligation to discontinue the measures (see a) below). However, due to their specific nature, this does not apply to remote searches (see b) below).

254

a) aa) In addition to the constitutional requirements relating to the general prerequisites for such interferences, the respective fundamental rights in conjunction with Art. 1(1) of the Basic Law give rise to particular requirements for the protection of the core of private life where surveillance measures entail particularly intrusive interferences. This protection guarantees the individual a domain of highly personal life that is free from state surveillance. Even exceptionally significant interests of the general public cannot justify an interference with this absolutely protected domain (cf. BVerfGE 141, 220 <276 paras. 119 f.>; 165, 1 <56 para. 102>; established case-law).

255

All surveillance measures must respect the core of private life. If the measure in question typically leads to the collection of data relating to the core of private life, the legislator must enact clear provisions that ensure effective protection. Where the powers in question do not entail such a high risk of violations of the core of private life, it is not necessary to enact such provisions. But when exercising those powers, the Constitution requires that limits regarding access to highly personal information in the individual case must be respected (cf. BVerfGE 141, 220 <277 f. para. 123>; 162, 1 <127 para. 278>).

256

The protection of the core of private life is absolute and must not be made conditional upon a balancing against security interests under the principle of proportionality (cf. BVerfGE 109, 279 <314>; 120, 274 <339>; established case-law). Yet this does not mean that every instance in which highly personal information is collected amounts to a violation of the Constitution or of human dignity. Given that uncertainties are inherent in measures and prognoses carried out by security authorities in the context of their duties, an unintended encroachment upon the core of private life in the course of surveillance measures cannot always be prevented from the outset (cf. BVerfGE 120, 274 <337 f.>). However, the Constitution does require that surveillance powers be designed in such a way that the core of private life be respected as an absolute limit, which cannot be freely circumvented on a case-by-case basis (BVerfGE 141, 220 <278 para. 124>).

257

Thus, it is absolutely impermissible for the state to make the core of private life a target of investigations (cf. BVerfGE 141, 220 <278 para. 125>, 165, 1 <60 para. 110>). Furthermore, it also follows that the protection of the core of private life must be given effect at two different stages when carrying out surveillance measures. Firstly, at the data collection stage, safeguards must be put in place to prevent the unintended collection of information relating to the core of private life wherever possible. Secondly, at the stage of subsequent data analysis and use, the consequences of an encroachment upon the core of private life that could not be prevented despite the presence of such safeguards must be strictly minimised (cf. BVerfGE 141, 220 <278 f. para. 126>; 165, 1 <59 f. para. 108>; established case-law).

258

bb) Within this framework, the legislator may design the protection of the core of private life differently for different surveillance measures, depending on the type of power and its proximity to the absolutely protected domain of private life (cf. BVerfGE 120, 274 <337>; 129, 208 <245>; 141, 220 <279 para. 127>).

259

At the data collection stage, with regard to measures that typically lead to the collection of data relating to the core of private life, a preliminary assessment must ensure that situations or conversations relating to the core of private life are excluded in advance to the extent that this is feasible with reasonable effort (cf. BVerfGE 141, 220 <279 para. 128>; 154, 152 <264 para. 206>; 165, 1 <61 para. 111>; established case-law). The statutory provision must ensure that the collection of data relating to the core of private life is avoided from the outset as far as this is possible from a technical and investigative perspective (cf. regarding remote searches BVerfGE 120, 274 <338>). It must further provide that the measure be discontinued at the data collection stage when it becomes apparent that the surveillance is encroaching upon the core of private life (cf. BVerfGE 141, 220 <279 para. 128>; 165, 1 <62 para. 113>). This applies in particular to the surveillance of private homes (cf. BVerfGE 109, 279 <318, 324, 331>; 141, 220 <300 para. 199>; 162, 1 <128 para. 281>) and in principle also to the use of police informants and undercover investigators (cf. BVerfGE 165, 1 <62 f. paras. 113 ff.>). That said, an obligation to discontinue the measure does not apply without exception (cf. in this regard BVerfGE 165, 1 <63 para. 115>), nor does it apply indiscriminately to all surveillance measures. In consideration of the type of data collection and the information thereby collected (cf. in this regard BVerfGE 129, 208 <245>), the legislator must only provide for an obligation to discontinue the measure if this can prevent the collection of information relating to the core of private life with reasonable effort. When it comes to telecommunications surveillance, for example, it may be difficult in practice to identify content that relates to the core of private life and to classify it as such (cf. in this regard BVerfGE 129, 208 <248 f.>).

260

b) Due to the specific nature of remote searches, an obligation to discontinue the measures in order to protect the core of private life is therefore not required.

261

aa) Given that covert access to IT systems typically entails the risk of recording highly confidential data, and thus bears a particularly close connection to the core of private life, it requires express statutory safeguards for its protection. Yet these constitutional requirements are not identical to those applicable to the surveillance of private homes in every respect. They shift the protection away from the collection stage towards the subsequent stage of analysis and use (cf. BVerfGE 120, 274 <335 ff.>; 141, 220 <306 para. 218>; 162, 1 <129 f. para. 284>). This is due to the technical nature of remote searches. In the context of such measures, protecting the core of private life involves preventing the retrieval of highly confidential information from within an existing comprehensive data pool of information kept in digital form that, taken as a whole, but typically not with regard to individual pieces of data, is of the same private nature as a person’s behaviour or communication within the home. As a result, the constitutional requirements for protecting the core of private life at the data collection stage are somewhat lower (BVerfGE 162, 1 <129 f. para. 284>; cf. also BVerfGE 141, 220 <306 f. paras. 218 f.>).

262

Yet for remote searches, too, it must still be ensured that the collection of information attributed to the core of private life is avoided as far as is possible from a technical and investigative perspective. In particular, available technical means must be used to implement such protection; where it is possible to identify and isolate highly confidential information through such technical means, access to this information is prohibited (cf. BVerfGE 120, 274 <338>; 141, 220 <307 para. 219>; 162, 1 <130 para. 285>).

263

If, however, data relating to the core cannot be deleted before or at the time of data collection, remote searches are nevertheless permissible even if there is a probability that highly personal data, too, might incidentally be collected. In this respect, the legislator must take into account the need for protection of affected persons by putting safeguards in place at the stage of data analysis and use, and by minimising the impact of remote searches (cf. BVerfGE 120, 274 <338 f.>; 141, 220 <307 para. 220>; 162, 1 <130 para. 286>).

264

bb) Based on these standards, the provisions for the protection of the core of private life at the data collection stage in § 100d of the Code of Criminal Procedure satisfy the constitutional requirements for remote searches. No further statutory safeguards in the form of an obligation to discontinue measures are needed (cf. in terms of the outcome BVerfGE 120, 274 <338>; 141, 220 <307 f. para. 222>; 162, 1 <141 para. 314>; regarding the surveillance of foreign telecommunications cf. BVerfGE 154, 152 <264 para. 206>; 170, 79 <138 para. 167>) in addition to the safeguards for the core of private life provided for in § 100d(1) and § 100d(3) first sentence of the Code of Criminal Procedure (cf. in this regard BVerfGE 141, 220 <308 para. 222>; 162, 1 <141 para. 314>).

265

No statutory obligation to discontinue measures is required in light of the specific nature of remote searches pursuant to § 100b of the Code of Criminal Procedure. Due to the way the data is collected and the type of information obtained, encroachments upon the core of private life that cannot be addressed by the aforementioned safeguards cannot be avoided with reasonable effort. In this respect, it must first be noted that the collection of data in the context of technical access to IT systems is for the most part automated for technical reasons. In comparison with data collection carried out manually, this automated process makes it more difficult to distinguish at the stage of data collection between data relating to the core of private life and data not relating to it (cf. BVerfGE 120, 274 <337>). But even if data is accessed manually by people (directly) listening in or reading along in real time, the protection of the core of private life – which can generally only be ensured sporadically with regard to surveillance in real time (cf. regarding telecommunications surveillance BVerfGE 129, 208 <248>) – encounters practical difficulties. During data collection, it is often hard to assess whether information relates to the core of private life, for example because conversations are held in a foreign language or online in a manner that is difficult to understand (cf. BVerfGE 120, 274 <338>; 129, 208 <248>) or because it is not possible to ascertain the personal relationships of the communicating parties (cf. BVerfGE 129, 208 <248 f.>).

266

However, the greatest challenge for the protection of the core of private life at the data collection stage arises from the fact that data of great volume and variety can not only be collected through the covert surveillance of an IT system by technical means , but that, due to the increasing possibilities of IT systems, data is generated, processed or stored in simultaneous processes. Unlike in case of the surveillance of spoken communication in someone’s home, there is therefore no clear point of reference. And unlike in case of confidential informants or undercover investigators, there are no specific communication relations or interactions that can generally be shaped by those carrying out the surveillance (cf. in this regard BVerfGE 165, 1 <62 para. 113>). Rather, it is typical of the use of an IT system that a number of different digital applications produce streams of data simultaneously, both prompted by the user and controlled externally or by the system. When a measure collects data relating to the core of private life stemming from specific uses or applications within an IT system, the same system can be further used for many purposes that bear no connection to the core of private life. If it becomes ascertainable that a surveillance measure encroaches upon the core of private life, it is not constitutionally required to terminate the entire measure in every case (cf. regarding the use of confidential informants and undercover investigators BVerfGE 165, 1 <62 para. 113>). But even a partial discontinuation of the measure can, in terms of its scope, hardly be properly delimited and implemented due to the various communication relations and interactions and the various types of data.

267

Notwithstanding the absence of an admissible challenge in this regard (cf. para. 151), if a surveillance measure yields data relating to the core of private life despite the safeguards in § 100d(1), (3) first sentence of the Code of Criminal Procedure, § 100d(2), (3) second sentence of the Code of Criminal Procedure provide ex post protection at the stage of analysis and data use given that communication contents attributed to the highly personal domain may not be used and must be deleted without delay (cf. in this regard BVerfGE 113, 348 <392>).

268

c) Insofar as remote searches pursuant to § 100b(1) of the Code of Criminal Procedure are not covered by the fundamental right protecting IT systems, for example because third parties are affected, the protection of the privacy of telecommunications or the right to informational self-determination, which are the only rights affected in these cases (cf. para. 244), cannot be more extensive than the protection that would be provided if the fundamental right protecting IT systems were applicable (cf. also BVerfGE 109, 279 <326>).

D. 

I. 

269

Ultimately, the provisions that were admissibly challenged do not entirely satisfy the constitutional requirements.

270

1. § 100a(1) second and third sentence in conjunction with § 100a(1) first sentence no. 1, (2) of the Code of Criminal Procedure in the challenged version of 17 August 2017 are unconstitutional insofar as they make reference to criminal offences in § 100a(2) no. 1(a), (c), (d) and (t), no. 6 and no. 7(b) of the Code of Criminal Procedure which carry a maximum penalty of no more than three years imprisonment (§ 85(2) of the Criminal Code, § 86(1) and (2) of the Criminal Code, § 97(2) of the Criminal Code, § 97b(1) first sentence in conjunction with § 97(2) of the Criminal Code, § 109g(1) in conjunction with (4) first sentence of the Criminal Code, § 109g(2) of the Criminal Code, § 129(1) second sentence of the Criminal Code, § 129(1) second sentence in conjunction with § 129b of the Criminal Code, § 130(2), (4) and (5) of the Criminal Code, § 310(1) no. 4 in conjunction with § 309(6) of the Criminal Code, § 313(2) in conjunction with § 308(6) of the Criminal Code, § 17(5) of the Foreign Trade and Payments Act, § 18(5a) of the Foreign Trade and Payments Act, § 30b of the Narcotic Drugs Act in conjunction with § 129(1) second sentence of the Criminal Code, § 30b of the Narcotic Drugs Act in conjunction with § 129(1) second sentence in conjunction with § 129b of the Criminal Code). The provisions violate the fundamental right protecting IT systems of complainants nos. 1) and 5); insofar as § 100a(1) second sentence of the Code of Criminal Procedure is concerned, they additionally violate Art. 10(1) of the Basic Law.

271

2. § 100b(1) of the Code of Criminal Procedure is unconstitutional. Due to its violation of the requirement that affected fundamental rights be expressly specified, the provision violates the fundamental right protected by Art. 10(1) in conjunction with Art. 19(1) second sentence of the Basic Law of complainants nos. 1), 2), 4) and 5). However, this does not mean that the entire law – in this case, the Act to Improve the Effectiveness and Practicality of Criminal Proceedings of 17 August 2017 (BGBl I pp. 3202 ff.) – is unconstitutional; rather, this is limited to the provision that gives rise to the violation of the requirement that affected fundamental rights be expressly specified as asserted by the complainants.

II. 

272

1. The finding that a statutory provision is unconstitutional in principle results in that provision being declared void. However, pursuant to § 31(2) second and third sentence and § 79(1) and § 93c(1) third sentence of the Federal Constitutional Court Act (cf. BVerfGE 166, 1 <88 para. 187> – Child marriages), the Federal Constitutional Court may limit its decision to declaring that an unconstitutional provision is merely incompatible with the Constitution. It then merely objects to the unconstitutional provision without declaring it void. The Court may combine the declaration of incompatibility with an order declaring that the unconstitutional provisions temporarily remain in force. This may be considered in cases where the immediate invalidity of the objectionable provision would eliminate the statutory basis for protecting exceptionally significant interests of the common good, and if a balancing of these interests against the affected fundamental rights requires that the interference be tolerated for a transitional period (BVerfGE 165, 1 <100 para. 201> with further references; established case-law).

273

2. a) Based thereon, § 100a(1) second and third sentence of the Code of Criminal Procedure must be declared incompatible with the Constitution and void to the extent that they are unconstitutional (see para. 270). In this respect, they do not satisfy the constitutional requirements. The legislator cannot remedy this unconstitutionality by adopting a provision with comparable legislative content.

274

The grounds rendering § 100a(1) second and third sentence of the Code of Criminal Procedure in the challenged version of 17 August 2017 (BGBl I p. 3202) partially void also apply to all subsequent versions with regard to the criminal offences listed in § 100a(2) of the Code of Criminal Procedure that provide for a maximum penalty of no more than three years imprisonment (cf. para. 270). Pursuant to § 78 second sentence of the Federal Constitutional Court Act, which is also applicable in constitutional complaint proceedings and to subsequent versions of a law (cf. BVerfGE 133, 377 <423 para. 106>), later versions of the law must also be declared incompatible with the Basic Law for the sake of legal clarity. This concerns all offences covered by the declaration of voidness, regardless of where in § 100a(2) of the Code of Criminal Procedure they are listed. It is therefore irrelevant that the provision under § 100a(2) no. 1(t) of the Code of Criminal Procedure, which, in the challenged version, lists the offences in § 310(1) no. 4 in conjunction with § 309(6) of the Criminal Code and § 313(2) in conjunction with § 308(6) of the Criminal Code, has been moved to § 100a(2) no. 1(u) of the Code of Criminal Procedure in the version of the Act Against Illegal Employment and Abuse of Social Security Benefits (Gesetz gegen illegale Beschäftigung und Sozialleistungsmissbrauch) of 11 July 2019 (BGBl I p. 1066).

275

b) In contrast, § 100b(1) of the Code of Criminal Procedure must merely be declared incompatible with the Constitution. The grounds for the unconstitutionality of this provision do not affect the core of the powers granted, but merely concern individual aspects of their design in light of the rule of law. The legislator can remedy the constitutional objections to this provision and thus realise the aims pursued by it in a constitutional procedure (cf. BVerfGE 150, 309 <344 f. para. 97>) by actively considering that, under the requirements of Art. 19(1) second sentence of the Basic Law, a power to carry out remote searches must also take into consideration Art. 10(1) of the Basic Law, and by being aware of this fact (cf. also BVerfGE 5, 13 <16>; 154, 152 <237 para. 135>). The unconstitutionality of the provision must be tolerated for a transitional period. The power to carry out remote searches is very significant for law enforcement in light of the advances in information technology. A declaration of voidness or a temporary order of suspension would involve considerable risks. In light of the great importance accorded to law enforcement, an order to continue to apply the unconstitutional provision for a transitional period is preferable to the immediate invalidity of the provision until a new provision has been enacted, which is expected to happen in the foreseeable future.

276

The declaration of incompatibility primarily concerns § 100b(1) of the Code of Criminal Procedure. Since this, however, leaves § 100b(2) through (4) of the Code of Criminal Procedure without an independent scope of application, § 100b of the Code of Criminal Procedure must be declared incompatible with the Constitution in its entirety. The grounds for the unconstitutionality of § 100b of the Code of Criminal Procedure also apply to all subsequent versions, which must therefore also be declared incompatible with the Basic Law for the sake of legal clarity (cf. para. 274).

277

3. […]