The BND ruling of the Federal Constitutional Court - Obligations to cooperate in telecommunications intelligence must continue to be observed
The strategic telecommunications reconnaissance of the BND
In its ruling of 19 May 2020 (Case No. 1 BvR 2835/17), Germany's Federal Constitutional Court declared the legal basis of the so-called " strategic overseas telecommunications reconnaissance" of Germany's Secret Service Bundesnachrichtendienst (BND) to be largely unconstitutional. Under the Federal Intelligence Service Act (BNDG), the BND is authorized to monitor the telecommunications (e.g. e-mails, telephone calls, chat messages) of foreigners in third countries without any specific reason. To this end, it issues so-called "extraction orders" to providers of telecommunications services, which oblige them to provide information and enable surveillance. It collects both traffic data and telecommunications content. These are subjected to a multi-stage, fully automated selection procedure based on search terms (this mainly includes formal search terms such as telecommunications identifiers). In this way, the BND selects and stores content data of approx. 270,000 telecommunication processes for further manual evaluation on a daily basis, of which an average of 260 processes are identified at the end for forwarding to so-called "adopting bodies".
Strategic telecommunications reconnaissance not inadmissible per se
It was mainly foreign journalists who had brought a constitutional complaint against this practice. The Federal Constitutional Court now followed their argument. The court criticises, inter alia, insufficient limitation of the surveillance according to purpose, insufficient protective measures e.g. to protect particularly affected persons such as journalists or lawyers, as well as the lack of adequate oversight.
On the other hand, however, the Federal Constitutional Court also states that the "authority to conduct reconnaissance abroad by means of strategic telecommunications surveillance [...] is not excluded from the outset" and "can be justified by the objective of reconnaissance abroad and its special conditions of action [...]". Strategic telecommunications reconnaissance is thus by no means a thing of the past because of the ruling but will continue to be carried out by the BND, albeit under different conditions. The German legislator now has until 31 December 2021 to reform the objected provisions. Until then they will remain in force.
Telecommunications providers: Instructions of the BND still to be observed
As a result, the ruling has only a minor impact on the providers of telecommunications services and telecommunications network operators. Until 31 December 2021, the current legal situation will remain unchanged. Under no circumstances, therefore, should the ruling be used as an opportunity for the providers to reject any orders of the BND. An infringement against a request for information constitutes an administrative offence and can be punished with a fine of up to twenty thousand Euro. Furthermore, the objected provisions address the BND exclusively. Their revised version will thus tighten the requirements for strategic telecommunications reconnaissance but will presumably not affect the providers' obligations to cooperate in enabling surveillance. Even after 31 December 2021, telecommunications providers will thus be confronted with extractions orders, which must be complied with as before.
Ensure compliance with the BNDG
In particular, § 8 of the BNDG, which contains the obligations of the providers of telecommunications services and those participating in them, remains unaffected. According to this provision, a company must, upon request, provide information on the detailed circumstances of telecommunications (traffic data), hand over consignments entrusted to it for transmission by telecommunications and enable the monitoring and recording of telecommunications (content data). The regulation is to be read in conjunction with § 110 of the Telecommunications Act (TKG), the Telecommunications Surveillance Ordinance (TKÜV), and its associated technical guideline (TR TKÜV), which contain the general obligations of service providers and system operators in connection with telecommunications surveillance.
A special requirement of the BNDG is the obligatory security check of the employees entrusted with the implementation of the measures within the company as well as the prohibition of the release of surveillance measures and requests for information, a violation of which is penalized under criminal law by threat of punishment with imprisonment of up to two years. Every employee entrusted with implementation must be instructed about this information release prohibition. Details on the required security check can be found in the Security Check Act (SÜG) and the Security Handbook (GHB) published by the Federal Ministry of Economics and Energy.
Conclusion and outlook
The BND ruling of the Federal Constitutional Court undoubtedly represents an important milestone both in terms of legal policy and constitutional law doctrine. It was therefore rightly given considerable attention in the legal press and in general reporting. However, it has far less impact on the practice of telecommunications service providers and telecommunications network operators. For them, by and large, everything remains the same. The strategic foreign telecommunications reconnaissance will not disappear as a result of the judgement but will continue to be operated by the BND. A rejection of extraction orders on the basis of the ruling, thus, cannot be considered.
The ruling may of course be taken as an opportunity to review one's company's compliance with the obligations imposed on telecommunications providers to enable strategic telecommunications intelligence. Have all the necessary internal processes and structures for the implementation of extraction orders been implemented? Employees who were selected and security checked in the past may have changed their position or even left the company and would need to be replaced. Also, the obligatory instruction about existing information release prohibitions should not be taken lightly in view of the threat of punishment under criminal law in the event of a violation.
Please do not hesitate to contact us for further information and support.