Loopholes über alles —

German spy agency can monitor its own citizens via technicality

Former BND lawyer: if citizen works abroad for foreign firm, it's fair game.

The "Ein Bett für Snowden" (A bed for Snowden) campaign continues quietly across Germany.
The "Ein Bett für Snowden" (A bed for Snowden) campaign continues quietly across Germany.

Germany's top foreign intelligence agency, known as the BND, has been revealed to claim a loophole that broadens its spying mandate, allowing it to snoop on its own citizens abroad if they are working for a foreign company or organization. Normally, the agency is not allowed to spy on German people or companies under Article 10 of the Basic Law regardless of where they live.

On Saturday, the Associated Press received confirmation from the German government "that work-related calls or emails are attributed to the employer. If the employer is foreign, the BND can intercept them."

The BND did not immediately respond to Ars' request for comment.

This statement stemmed from the testimony of a former BND lawyer, who answered questions last week before a parliamentary intelligence committee—dubbed the "NSA Committee." Founded in March 2014, the committee is tasked with (PDF) specifically investigating "whether, in what way, and on what scale" the US and its Five Eyes allies "collected or are collecting data" to, from, and within Germany.

In October 2013, it was revealed that the United States had been spying on German government leaders, in particular Chancellor Angela Merkel. While many officials have expressed outrage, other opposition politicians in parliament believe that the dust-up is manufactured, as the government implicitly or explicitly supports surveillance by Germany’s own BND, a longstanding NSA ally.

On Sunday, the German magazine Der Spiegel (Google Translate) reported that the BND informed the Chancellor’s office as early as 2005 (long before Snowden revealed himself to journalists and to the public in 2013) that Germany was a target of the NSA.

Given recent history with both the Nazi regime and East Germany, modern Germany is very concerned with privacy rights and data protection. This reputation has enticed a number of "digital exiles" to Berlin, most notably Laura Poitras (one of the journalists who broke the Edward Snowden story), and Jacob Appelbaum, a well-known American computer security researcher and Tor developer.

Some Germans have called for their home country to offer asylum to the famous whistleblower and have begun a "Ein Bett für Snowden" (A bed for Snowden) campaign.

Trust us

The former BND lawyer speaking before the NSA Committee was Stefan Burbaum, who worked at the BND from 2002 until 2005.

"The office holder is the legal person," he said, according to a German-language liveblog provided by the German tech policy blog Netzpolitik (Google Translate). "It's a small exception. But a German citizen can function as an office holder in a foreign organization."

Under questioning from Hans-Christian Ströbele, a veteran Green Party parliamentarian from Berlin, asked as an example if the head of the German charity Welthungerhilfe (World Famine Aid), when working abroad, would be protected. (The Kabul office of Welthungerhilfe was monitored from 2005 until 2008, when it was revealed by the German magazine Der Spiegel.) Ströbele also famously met with Snowden in Moscow in November 2013.

"The decisive thing is whether he's communicating as a citizen or as an office holder," Burbaum added. "Any communication from Siemens would be protected because Siemens is a German company."

But he assured the committee that such practice has taken place "almost never."

Channel Ars Technica