Trojan I and II
In orders published today, the First Senate of the Federal Constitutional Court rendered its decision on two constitutional complaints concerning statutory authorisations in (preventative) police law and criminal procedural law. With their constitutional complaint in the proceedings 1 BvR 2466/19 (Trojan I), the complainants challenge the statutory authorisation for (source) telecommunications surveillance in police law contained in § 20c of the North Rhine-Westphalia Police Act (Polizeigesetz des Landes Nordrhein-Westfalen – PolG NRW); in the proceedings 1 BvR 180/23 (Trojan II), they challenge the statutory authorisations for source telecommunications surveillance and remote searches in criminal procedural law contained in § 100a(1) second and third sentence and § 100b(1) of the Code of Criminal Procedure (Strafprozessordnung – StPO).
To a large extent, the constitutional complaints are already inadmissible. For the most part, the complainants do not demonstrate the possibility of a violation of fundamental rights in a sufficiently substantiated manner. To the extent that the constitutional complaints are admissible, they are only partially successful.
In its orders, the Senate held: The provisions of the North Rhine-Westphalia Police Act, which were admissibly challenged, are compatible with the Basic Law in their entirety. The challenged provisions of the Code of Criminal Procedure are unconstitutional in part. Source telecommunications surveillance for the investigation of criminal acts which only carry a maximum sentence of imprisonment of three years or less is not proportionate in the strict sense and was therefore declared void by the Senate. The statutory authorisation for remote searches, which (also) authorises an interference with the right to privacy of telecommunications protected by Art. 10(1) of the Basic Law (Grundgesetz – GG), does not satisfy the requirement that the affected fundamental right be expressly specified (Zitiergebot) and is therefore incompatible with the Basic Law. However, this provision will continue to apply until the legislator adopts a new provision.
Facts of the case:
The provisions challenged in the proceedings essentially provide the following:
I. § 20c of the North Rhine-Westphalia Police Act regulates police powers to conduct telecommunications surveillance and source telecommunications surveillance.
§ 20c(1) of the North Rhine-Westphalia Police Act regulates police powers to conduct classic telecommunications surveillance and permits the surveillance and recording of ongoing telecommunications in real time without the knowledge of the individual targeted by the measure.
In accordance with § 20c(2) of the North Rhine-Westphalia Police Act, the surveillance and recording of telecommunications may also take place through accessing by technical means information technology systems (IT-systems) used by the individual targeted (source telecommunications surveillance). Surveillance through accessing an IT-system aims to also capture such contents of communication which, due to their encryption, could not be analysed, or could only be analysed with unreasonable effort, in case of basic telecommunications surveillance. In these instances, the communication may be accessed at the ‘source’, i.e., where the contents of the communication have not yet been encrypted or have already been decrypted again.
II. § 100a(1) second and third sentence and § 100b(1) of the Code of Criminal Procedure permit the covert surveillance of IT-systems for the purposes of criminal prosecution.
1. The challenged statutory authorisations regarding source telecommunications surveillance in criminal procedural law distinguish whether access to the IT-system aims to surveil and record telecommunications in real time (§ 100a(1) second sentence of the Code of Criminal Procedure) or to surveil and record previously conducted telecommunications stored on the system (§ 100a(1) third sentence of the Code of Criminal Procedure).
a) Source telecommunications surveillance pursuant to the second sentence of § 100a(1) includes, both technically and legally, the same data as ‘classic’ telecommunications surveillance and thus all incoming and outgoing data from the device under surveillance.
b) Extended source telecommunications surveillance pursuant to the third sentence of § 100a(1) instead authorises the surveillance and recording of the contents and circumstances of communications stored on the IT-systems of the individuals targeted by the measures. The legislator intends this provision to supplement source telecommunications surveillance pursuant to § 100a(1) second sentence by also allowing access to contents and circumstances of the communication for which the process of transmission has already been concluded and which are still stored on the IT-system of the individual targeted by the measure. In this regard, it must be ensured that only such contents and circumstances of communication which could also have been surveilled in real time following the issuing of a court order may be made the subject of surveillance.
2. The provision regarding remote searches in § 100b(1) of the Code of Criminal Procedure is also challenged. This provision permits accessing an IT-system used by the individual targeted by the measure and the collection of data from such systems. Unlike source telecommunications surveillance, remote searches permit access to the entire IT-system. They capture the entire user behaviour of an individual, including the contents and circumstances of ongoing communication, as well as any data stored on the system.
Key considerations of the Senate:
A. The constitutional complaints are only admissible in part.
I. In the Trojan I proceedings, the complainants demonstrated only in part that the powers provided for in § 20c of the North Rhine-Westphalia Police Act possibly violated the fundamental right to the protection of the confidentiality and integrity of information technology systems (Recht auf Gewährleistung der Vertraulichkeit und Integrität informationstechnischer Systeme – IT-System-Grundrecht, fundamental right protecting IT-systems) contained in Art. 2(1) in conjunction with Art. 1(1) of the Basic Law, as well as the fundamental right to privacy of telecommunications (Fernmeldegeheimnis) under Art. 10(1) of the Basic Law. In this regard, the complainants sufficiently demonstrated the possibility of a violation of fundamental rights insofar as they argue that some of the terrorist offences referenced through the referral to § 8(4) of the North Rhine-Westphalia Police Act do not protect sufficiently weighty legal interests.
However, the rest of the complainants’ submissions do not meet the substantiation requirements. Among other things, they failed to sufficiently demonstrate a violation of the requirement of specificity and legal clarity, or that the powers of source telecommunications surveillance are inherently contradictory. They also did not show that the challenged powers could interfere with the core of private life, which enjoys absolute protection.
II. In the Trojan II proceedings, the constitutional complaint is admissible insofar as it challenges both forms of source telecommunications surveillance and the insufficient severity of the criminal acts at issue. It is also admissible to the extent that it challenges remote searches and alleges a violation of the requirement to specify affected fundamental rights, as well as an insufficient protection of the core of private life due to the fact that the circumstances under which such measures must be discontinued are not specified.
For the rest, the constitutional complaint is inadmissible. In particular, the complainants failed to sufficiently demonstrate an interference with the right to privacy of telecommunications under Art. 10(1) of the Basic Law with regard to extended source telecommunications surveillance pursuant to § 100a(1) third sentence of the Code of Criminal Procedure. Art. 10(1) of the Basic Law only protects against the specific risks of remote communication. The protection provided by Art. 10(1) does not extend to the contents and circumstances of communication outside of an ongoing process of communication, i.e., after the conclusion of the transmission, which is stored in the domain controlled by the individual targeted.
B. To the extent that the constitutional complaints are admissible, they are not (Trojan I) or only partially (Trojan II) founded on the merits.
I. The statutory authorisations, which have been admissibly challenged, interfere – to different degrees – with the right to privacy of telecommunications protected by Art. 10(1) of the Basic Law and the fundamental right protecting IT-systems under Art. 2(1) in conjunction with Art. 1(1) of the Basic Law.
1. Art. 10(1) of the Basic Law protects against the specific risks associated with remote communication and in this way safeguards privacy at a distance. These risks not only manifest during telecommunication between two or more people. Due to its openness to adapt to new developments, Art. 10(1) also protects against new risks caused by the increasing importance of information technology for the development and exercise of individual personality, and thus also protects other data transmitted across distances by means of telecommunications technology. Such fundamental rights protection is also necessary, as the holders of fundamental rights, for the remote transmission of potentially sensitive personal data, depend on a process which they cannot control and which may be accessible to third parties. They have a legitimate expectation of confidentiality regarding the contents of the communication and the circumstances of its transmission.
2. The protection afforded by the fundamental right protecting IT-systems particularly extends, but is not limited, to covert access via remote searches. It protects IT-systems owned by the user, which may contain, by themselves or due to network connections, personal data of users in such volume and variety that access to the system grants insights into essential aspects of one’s personal life or even allows for the creation of a comprehensive personality profile. The fundamental right protecting IT-systems safeguards the confidentiality and integrity of the information technology systems within its scope of protection. It not only protects the confidentiality of data violated during, but also in anticipation of a process of data collection. The process of accessing an IT-system in itself gives rise to specific risks for the data created, processed and stored within or accessible through the system. The specific guarantees of the fundamental right protecting IT-systems thus extend beyond the protection of personal data and provide anticipatory protection of one's personality. Consequently, its scope of protection must always be defined with reference to a specific IT-system and extends across all risks associated with that system as a whole.
To the extent that a measure affects both the fundamental right protecting IT-systems as a manifestation of the general right of personality and Art. 10(1) of the Basic Law, the fundamental right protecting IT-systems does not automatically have to stand back behind the freedom guaranteed by Art. 10(1) of the Basic Law, which is more specific than the general right of personality. This is because the fundamental right protecting IT-systems has its own separate and specifically defined scope. Source telecommunications surveillance limited to ongoing telecommunications must therefore be measured against the standards of both fundamental rights.
3. A provision granting the power to access, covertly and by technical means, an IT-system used by the individual targeted and to collect its data, including from ongoing telecommunications (remote searches), enables interference with both the fundamental right protecting IT-systems and Art. 10(1) of the Basic Law. The power to conduct remote searches must also be measured against the standards of both fundamental rights.
4. The right to informational self-determination, as a manifestation of the general right of personality (Art. 2(1) in conjunction with Art. 1(1) of the Basic Law), not only protects against individual instances of data collection, but also against access to large datasets, which are typically highly informative. However, if a provision authorises data collection from an IT-system accessed through technical means, the right to informational self-determination is superseded by the fundamental right protecting IT-systems. Among these two manifestations of the general right of personality, the fundamental right protecting IT-systems offers a more specific protection – focused on the violation of their integrity and risk to confidentiality associated with the access to IT-systems owned by the user – than the right to informational self-determination.
II. The surveillance authorisations granted to police through § 20c of the North Rhine-Westphalia Police Act are unobjectionable under constitutional law and, when measured against the intensity of the interference caused, also proportionate in the strict sense.
1. A covert surveillance of telecommunications with at least severe effects, particularly if the threshold for interferences set by the provision may be met before a specific danger has been identified, as in the present case, is only permissible for the protection or defence of especially weighty legal interests. This includes life, limb and liberty of the person as well as the existence or security of the Federation or a Land.
The legislator can ensure the necessary weight of the legal interest protected in the area of preventative measures for the protection of public safety by linking the authorisations for such measures to sufficiently severe criminal acts from the outset. Irrespective of the severity of the criminal act, the legislator can also ensure the necessary weight of the legal interest protected by additionally reviewing the legal interests at stake or by introducing sufficient standards for the qualification of a criminal act as a terrorist offence in an individual case. Thus, it would suffice if the criminal acts listed by the legislator are directed, in a sufficiently qualified way, against the especially weighty legal interests identified above. If the legislator does not explicitly align a criminal act with the protection of such especially weighty legal interests, the necessary weight of the legal interest protected can also be ensured if the legislator requires the criminal acts referenced in the legislative authorisation in police law to serve the protection of such legal interests in an individual case. This may especially be the case for criminal acts that are classified as terrorist offences. The circumstances in which this is the case are more closely determined by the legislator in § 129a(1) and (2) of the Criminal Code (Strafgesetzbuch – StGB) and limited to specific, characteristic criminal acts of particular severity.
2. In accordance with these standards, the challenged authorisation limits (source) telecommunications surveillance to the protection of sufficiently weighty legal interests by way of reference to the terrorist offences specified in § 8(4) of the North Rhine-Westphalia Police Act.
Those criminal acts listed in § 8(4) first half-sentence of the North Rhine-Westphalia Police Act which carry a maximum sentence of imprisonment of at least ten years are considered particularly serious criminal offences. The legal interests protected by them are sufficiently weighty from the outset. In addition, many of the criminal acts listed in that provision concern criminal acts that directly threaten life and limb or meet the narrow requirements to qualify as material assets that warrant protection. But even if this is not the case, the necessary weight of the legal interest protected is safeguarded by the fact that surveillance for the purpose of preventing any of the criminal acts listed in § 8(4) of the North Rhine-Westphalia Police Act is only permissible if, in an individual case, the criminal act in question meets the standards of a terrorist offence as specified therein.
III. 1. The interference with both the fundamental right protecting IT-systems and Art. 10(1) of the Basic Law caused by source telecommunications surveillance under § 100a(1) second sentence of the Code of Criminal Procedure cannot be justified insofar as such source telecommunications surveillance is permitted for the investigation of criminal acts which carry a maximum sentence of imprisonment of three years or less and therefore fall into the category of basic criminality.
When considered in an overall assessment, source telecommunications surveillance causes a very severe interference with both Art. 10(1) of the Basic Law and the fundamental right protecting IT-systems. Manner and scope of the data collection, which occurs covertly and through direct circumvention of security mechanisms, in themselves intensify the interference with fundamental rights as source telecommunications surveillance permits access to data records which, in terms of their volume and variety, may by far exceed traditional sources of information. Source telecommunications surveillance enables the interception and analysis of all raw data exchanged and thus has an exceptional reach, particularly given the realities of modern information technology and its significance for communication relations. The data that can be intercepted not only carries a vast variety of types of electronic communications, which can then be analysed. Given the ubiquitous and diverse use of IT-systems, all forms of activity of individuals and of human interaction are increasingly reflected in electronic signals and thus become accessible through source telecommunications surveillance in particular. On top of this, the integrity of an IT-system is adversely affected and its confidentiality is at risk.
Because of the very high intensity of the interference, source telecommunications surveillance, for reasons of proportionality in the strict sense, must be limited to the investigation of particularly serious criminal offences. With regard to measures that serve law enforcement purposes, this assessment depends on the severity of the criminal acts targeted by the measures, which the legislator has divided into different categories, namely considerable, serious and particularly serious criminal acts.
With reference to the statutory sentencing range, a criminal act can be regarded as particularly serious at least where it carries a maximum sentence of imprisonment of more than five years. A criminal act that carries a maximum sentence of imprisonment of at least five years can also be classified as a particularly serious criminal act, if this appears justified not only with regard to the protected legal interests and their importance to society, but also with regard to the way in which the criminal act was committed and its consequences.
If a criminal act carries a maximum sentence of imprisonment of three years or less or a fine, it falls into the category of basic criminality which precludes its classification as a particularly serious criminal act from the outset.
Consequently, the interference with fundamental rights caused by the authorisation of source telecommunications surveillance in § 100a(1) second sentence of the Code of Criminal Procedure is not justified insofar as it permits the investigation of criminal acts which carry a maximum sentence of imprisonment of only three years or less. In the context of criminal procedural law, unlike in police law, it is not possible to conduct an additional review of the legal interests at stake for such criminal acts that fall into the category of basic criminality. Therefore, even if a criminal act would qualify as, for example, a terrorist offence in an individual case, this would be irrelevant.
2. When measured against its impact, the interference with the fundamental right protecting IT-systems caused by the authorisation of extended source telecommunications surveillance in § 100a(1) third sentence of the Code of Criminal Procedure is not justified insofar as it permits the investigation of criminal acts which carry a maximum sentence of imprisonment of three years or less and thus only fall into the category of basic criminality.
3. If the IT-system that is accessed is used by those affected as their own, the authorisation to conduct remote searches permits interference with both the fundamental right protecting IT-systems and Art. 10(1) of the Basic Law.
For formal reasons, the legislative authorisation of remote searches is incompatible with the Constitution. Insofar as the provision (also) grants powers to interfere with Art. 10(1) of the Basic Law, it does not satisfy the requirement that the affected fundamental right be expressly specified laid down in Art. 19(1) second sentence of the Basic Law.
By contrast, the absence of a legislative obligation to discontinue remote searches undertaken in real time under specific circumstances does not lead to a fundamental rights violation.
C. Consequently, to the extent of their unconstitutionality, § 100a(1) second and third sentence of the Code of Criminal Procedure must be declared incompatible with the Constitution and void. The legislator cannot remedy this unconstitutionality by adopting a constitutionally compatible provision with comparable legislative content.
In contrast, § 100b(1) of the Code of Criminal Procedure must merely be declared incompatible with the Constitution. The legislator can remove the constitutional objections to this provision by actively considering that, under the requirements of Art. 19(1) second sentence of the Basic Law, an authorisation for remote searches must also be regulated in light of Art. 10(1) of the Basic Law and holding itself accountable in this regard. The provision will continue to apply until the legislator adopts a new provision.