This article is a response to the following discussion prompt: To what extent does Germany's new BND draft bill provide a rights-based and modern framework for foreign intelligence? A number of different contributions have addressed this question or will do so soon. See all of them here.
Far from a radical overhaul of the mass surveillance of online communications practiced by the Federal Intelligence Service (BND) and its partners, the Chancellery’s new draft BND bill, which comes in response to a landmark ruling by the German Constitutional Court, is a brazen attempt to rewrite the rules without changing the game. Substantial changes are necessary if this bill is to meet the standards set by the Court for a democratic compromise between the pursuit of security interests and the protection of press freedom and fundamental rights. Following Reporters Without Borders’ successful constitutional complaint, journalists and their sources in particular must be able to rely on clear-cut and independently overseen safeguards against undue state surveillance.
Half a year after Germany’s highest court declared the legal framework for the BND’s foreign signals intelligence unconstitutional — sending the government back to the drawing board on a law that was only drawn up in 2016 — the Chancellery has now published a draft bill for a new Foreign Intelligence Act. It is certain to reignite an already polarised debate: To those focused on maximising the BND’s abilities to collect information, the limitations set by the Court’s ruling that found their way into the draft bill, present an undue burden. To those who fought for effective limitations to the state’s ability to spy on the confidential communication of journalists and other professionals, who would enjoy special rights in the domestic realm, the bill falls far short of the changes the Court called for. That is to say, it even falls short of the minimum requirements for a constitutional legal framework, never mind any more ambitious effort to comprehensively protect human and fundamental rights against ever-increasing surveillance powers.
The Constitutional Court ruling
The Constitutional Court’s recognition of German state authorities’ duty to accord foreigners abroad protective rights in line with the Basic Law’s protections of press freedom and the secrecy of telecommunications was indeed a milestone, unprecedented also in Europe’s coming to terms with the Snowden revelations. As was the call for a reform of the fragmented and insufficient oversight structure. Yet, the ruling also carefully weighed necessary powers to protect the state on the one side, and legitimate and equally necessary curbs to the intelligence service’s ability to intrude on confidential communications on the other.
From a press freedom perspective, the ruling also contained caveats to those limitations, which were hard to swallow. The court accepted that limited exceptions to the general ban vis-à-vis the surveillance of confidential communications could be made, for instance for the sake of intelligence gathering limited to informational reports without immediate repercussions to those surveilled. It thereby failed to take into account the broader implications for journalistic confidentiality.
The BND has access to massive amounts of data flowing through one of the world’s largest internet nodes in Frankfurt. According to the testimony of a BND representative, the intelligence service collects more than 150,000 pieces of content per day, plus hundreds of millions of metadata. In light of the sheer scale of the bulk collection of communications data, creating transparent limits to what intelligence services can do with this data as well as installing appropriate oversight mechanisms is an essential task of any democracy.
More of the same
As we argued in our formal statement on the draft bill, however, it gives the BND extensive freedom to continue collecting information about journalists’ sources and research. If it were to pass the legislative process without further changes, the bill would severely harm foreign journalists’ right to privacy and confidentiality, the protection of their sources, and at worst, their safety. It would likely also damage German media outlets, which cooperate with international partners on a regular basis — especially on high-profile investigations such as the Panama Papers — and often employ local staff in their bureaux abroad.
Even though the draft bill formally recognises special rights for journalists and other persons bound to professional secrecy in line with the Constitutional Court’s ruling, it wholly fails to implement appropriate safeguards. The narrow definition of ‘personal data’ (§ 21) can be interpreted to allow for any collection and analysis of journalists’ communication and research as long as all references to specific persons are removed. Of course, article 5 of the German constitution does not simply protect the personal rights of journalists, but also the confidentiality of all journalistic activity. So merely removing hints to the author and addressee of a given communication does not legitimize the BND’s analysis of its contents. Overly broad exemptions in the interest of intelligence gathering for early risk detection weaken the aforementioned protective rights further, particularly when considered in connection with the newly included (albeit already practiced) intrusion powers with regards to foreign servers and networks. Journalistic research must neither become a by-catch of intelligence measures against political targets nor be intentionally abused as a shortcut to information of interest to the BND, as has been the case in the past.
Protective rights without safeguards
The Chancellery’s interest in carrying forward as much of the established practice as possible is perhaps most explicit in the lack of any application of journalists’ protective rights when it comes to telecommunications meta data. The analysis of contact addresses, numbers, and other meta data alone, which like the content of a communication ought to be subject to the protection of telecommunications secrecy, provides extensive information about the confidential relationships between journalists and informants. Even the subject lines of mails, which allow for even more far-reaching insights into the contents of a communication and thus fall within the core area of confidentiality relationships, are technically part of the metadata of an e-mail. Nevertheless, the draft bill does not provide for any protection of media professionals or their sources in this respect. It even permits the transfer of unfiltered data sets to other intelligence services, whose rightful use of the data can neither be guaranteed nor verified.
One man’s journalist is another man’s propagandist
Another critical omission is the lack of transparent and clear criteria for who is to be considered a journalist and therefore granted protective rights. The extensive and revealing explanatory comments to the draft law state that no special protections apply to “representatives of foreign intelligence services disguised as journalists or persons who carry out media propaganda for journalistic and extremist groups”. The wording is an improvement on a previous draft, which even more worryingly referred to the highly contested and variably interpretable term of “fake news”. The essential problem, however, remains: the BND is supposed to exercise sole decision-making power over the political legitimacy and intentions of journalistic reports, removed from any independent oversight. Whilst limitations to who might legitimately call themselves a journalist and thereby claim related rights are necessary, transparent criteria must be applied that relate to the process by which trustworthy journalistic reports are produced, not the content itself. Reporters Without Borders (RSF) has repeatedly pointed out that such criteria exist; one such example is the standard developed by the Journalism Trust Initiative, which could provide concrete reference points for relevant criteria.
So far, there is no obligation for the BND to even document its classification for the benefit of an intelligence oversight institution. It is unfortunately yet another example of the continuation of the existing practice — regulating essential requirements and powers in secret, in this case in a non-public manual — which the Federal Constitutional Court explicitly criticised in its ruling.
Lack of effective oversight
All of the aforementioned safeguards are only as effective as their independent oversight allows them to be. Overall, the envisaged restructuring of intelligence oversight with a view to independently ensuring the protection of confidential relationships does not go far enough. Far from being an overly cumbersome structure or an impediment to the BND’s effectiveness, functional and independent oversight is a prerequisite for a rights-based intelligence framework that enjoys both public trust and focuses on critical hazards. Both civil society actors and the Federal Commissioner for Data Protection and Freedom of Information (BfDI) have proposed alternative ways of dealing with this matter, yet those more ambitious concepts were dismissed in favour of what is strictly necessary to conform to the ruling. The tight time frame of this reform — deadline for a new law is December 2021 — should not lead to missed opportunities in revising the oversight system.
The draft bill’s concept for the new Oversight Council that will review the legality of signals intelligence operations in advance of their execution is subject to restrictions that would hamper its ability to make an informed judgement or discover shortcomings. In the case of confidential relationships, it is neither to control the aforementioned classification nor is it granted information about the search terms, which steer the collection of data. Thus, it falls to the administrative oversight body to uncover possible transgressions, while the Oversight Council is restricted to an “observer role” with limited rights of objection. All of the more ambitious suggestions of a strengthened administrative oversight institution were too easily tossed aside, such as: the inclusion of more diverse expertise in the ex-ante control, both technical and practical (e.g. involving experts on human rights and press freedom), or even an adversarial procedure that would include an advocate for the rights of those affected by intelligence operations.
Conclusion
The Constitutional Court’s ruling ought to be seen as an opportunity to fundamentally reassess alternatives for a truly democratic and transparent framework for the BND’s signals intelligence operations. Unlike in 2016, when the draft bill for the BND Act 1.0 passed parliament without any meaningful changes, this time around, the Chancellery’s proposal must be significantly revised in the Bundestag. There is much to be done if the new BND Act is to conform to the Court’s ruling regarding functional safeguards for the confidentiality of journalists’ work and their communication with sources. Protecting press freedom is a key interest of any democratic state which unaccountable security services must not undermine. Years after the public first learned about the scale of intelligence services’ surveillance of citizens’ communications, the German legislature is offered another opportunity to create a legal framework that strikes a balance between national security interests and the fundamental rights of the individual. This time it should take it.