Photo: Andreas Labes

Joachim Güntner: It used to be that when people heard about hackers, especially ones in a Chaos Club, they had an image of scatterbrains, social nuisances.

Constanze Kurz: The image of the club has changed for the better, but there are still people who talk about hackers without differentiating between those who do it with criminal intent and those with ethical standards.


The Chaos-Computer-Club recently discovered a trojan on hard drives that seemed suspicious to their users, a trojan apparently launched by government authorities. In what way did this online spy-service violate the rights of the citizens affected?

Kurz: In fact it gave a kind of general authorisation to technically sniff out the infiltrated computers. It was not only able to divert data, but additional malware could be uploaded and executed by remote control. The entire hard drive of the targeted person was open to search by investigators. It was also possible to activate the camera, the microphone, or perform a keypad protocol. It went as far as acoustic and visual surveillance of the person's home.

What makes this case so particularly scandalous?

Kurz: You can't exclude the possibility that data could be transferred from a user's core private sphere. It is this core private realm that the German Federal Constitutional Court deemed particularly worthy of protection. The kind of software we analysed is a kick in the face to the protection of fundamental personal rights. Thoughts that a computer user notes on his machine can be read by investigators, even if they are not communicated to the outside world. Also at stake is the violation of personal secrets or business secrets. Ultimately, the use of this software was a clear breach of law.

Your book, published last spring, deals with various forms of "Datenfresser" (data eaters), which can be found in government and in business. Was your book inspired by any specific incident?

Frank Rieger: For one, there was no other book that illuminated the financial framework of "paying with data" and explained how these mechanisms function. We show the current trajectory government and society are on and why it sometimes looks as if the private sphere is a notion of the past.
Kurz: Only when people know what happens behind the back of the person providing the data can they change their behaviour. We are now at the threshold of a technological shift. If things are going to take a different track, then the consensus has to change. From this perspective our aim is not just educational but also political.

The random surveillance of average citizens through the collection of data raises a number of issues. Also longstanding issues. Cameras in public space have been tracking us for a long time. Did the main problem only first arise with the advent of digitalisation?

Kurz: And through networking, through the algorithmic and automatic processing of data into new comprehensive contexts.
Rieger: Given the way in which we slid into the current information society, all the steps were recognisable to the point that people thought: Oh, it's not going to be that bad, because the technology is not far enough along. In terms of camera surveillance of public space, there was the consolation that it was just a person sitting there and looking at the monitors in real time. But soon cameras became digital, and it was possible to send the video material to processing centres. The next step was the increased capacity of hard drives and the simultaneous decrease in price for data storage. And then came data networking. Now we are experiencing such an increase in computer capacity, that it is possible to cheaply and easily analyse data automatically.

Not many citizens realize what this moment of transition really means. Today the attitude predominates: Let them feed on data, no one is going to look at it all anyway.

Rieger: It's true, the East German secret police, the Stasi, was actually drowning in its own information. But this example should not reassure anyone, because a huge amount of technological progress has been made since then.
 
Business and government feed on data, while citizens scatter theirs everywhere.

Kurz: SMS, mobile inquiries for train schedules, networking with friends while on the go, Google Maps, "knowledge in your pocket" – this is all very practical. The use of these tools, coupled with their convenience, has already changed a lot of social patterns.
Rieger: Today we can't yet determine what effects this permanent shift in digital lifestyle will have, what kind of knowledge is being acquired in the process. When there were protests against Neo-nazis in February 2011 in Dresden, the police tracked mobile phone calls made by residents, journalists, lawyers and politicians. This scandalous practice only became public in June. It showed how naturally the police go about identifying communication groups and analysing patterns of movement. In Belarus and Iran the politics of surveillance goes a step further. The police collect the communication data associated with an ongoing demonstration, but stay quiet as long as western correspondents are present. Then afterwards they go out and arrest people. Communication structures have delivered the opposition to law enforcement on a silver platter.

In this way satisfying the security interests of the state, which exist even in democratic countries. The keyword here is "crime prevention".

Rieger: It's more complex than that. These technologies always hold a promise, the promise of increased efficiency. That is why they are introduced. Within the government, right now we don't want to pay much anymore for "physical" security. Everywhere crime-fighting jobs are being cut. The ideology that prevails on the internet – of not wanting to pay for content, but giving away data in exchange and still believing that the services received are free – has meanwhile also been accepted by governments. They link their promise of security to the idea that citizens who do not want to pay for more security through higher taxes have to reveal more about themselves. Data retention and biometrics are good examples.

Did the European Community guidelines for data retention promote crime-solving?

Kurz: Neither earlier evaluations nor those dating from the 18 months of German police practice that was in place before the Federal Constitutional Court stopped the retention of data showed any measurable effect. The same applies in other European countries. What you do see, is that in some countries the police and intelligence services are accessing this data to a huge extent.
Rieger: But still the number of crimes solved has not increased.


It sounds as if the state were deceiving us about its failures.

Kurz: Behind this is the massive lobby of the Federal Office of Criminal Investigation, the individual state Offices of Criminal Investigations and also the German police.


But why would they do this, if it does not help to solve crimes?

Kurz: For example, out of the need to compensate for the loss of several thousand police jobs. Or out of a faith in technology that is fuelled by the manufacturing companies. Rieger: The political impetus is likely aimed towards preparing for future crises. It does not seem likely that times are getting any better. Take Greece, for example. The last investment made last spring in the face of the spending freeze was a nationwide telecommunications surveillance system.


You mean in anticipation of social unrest?

Rieger: Yes. And I don't think it's any different in our country.
Kurz: The divide between rich and poor has been widening for years, and that leads to social dissonances. The eternal juxtaposition of freedom and security has always been a chimera. It's not about security. It's about control.
Rieger: Technically speaking, the software used by the police in Saxony is no different from that used in Iran or Belarus to monitor structures. These kind of monitoring tools can be used most efficiently not for fighting crime but for combating political dissent.


What applications do the manufacturers of these technologies promise?

Rieger: It is telling that they don't advertise them as being able to solve more robberies or catch more terrorists.
Kurz: Civil society must debate about what we want to allow – and not leave this to the police in Saxony, for example, that simply takes action. We see police authorities as structurally violating the law, and doing so precisely in the high-end range of disputed technical possibilities. It's the same with the government trojan, the computer bug.


The fact that technical possibilities are constantly expanding is the way of the world. But the key issue is the legal framework, which ensures that not every technical possibility is also socially or politically possible. This is what sets a constitutional democracy apart from autocratic systems.

Rieger: But the legal framework has to protect us in order to guarantee this. When the data is already there, as with data retention, then it is foreseeable that it will be used if there is a crisis. With house searches or computer confiscations we repeatedly notice a tendency to overstep the limits set by law. Even the provisions of the Federal Constitutional Court are ignored. We also observe illegal surveillance measures, the use of unapproved tools, which are then not documented. It is typical to inflate the initial suspicion, so that you can more easily get court permission for the operation. After the fact there is no mention of such dramatic suspicions, but the data gathered during surveillance is then used nevertheless.


What are you demanding?

Rieger: Limit the authority of the police and secret services to legitimate and necessary methods. We need a consensus as to what this is, and this includes a discussion on the concept of efficiency: What concrete results does a particular measure have? What have we gained from it? What parameters are used to measure success?


Together with other authors you were invited by the Federal Constitutional Court to write an evaluation on data retention, and you have repeatedly contradicted its proponents.

Rieger: We – and in the hearing also the judges – demanded crime statistics proving the assertion that data retention is an appropriate means of fighting serious crime. As an answer we heard only cock-and-bull stories, stories from the everyday life of the criminal. Never did we see any statistics, any criminological evaluation.
Kurz: The German state is certainly one of the best in terms of determining unlawful action after-the-fact. But in order to find a balance between the technically possible and the legally permissible, we need transparency and debate. It can't become the rule that the police first just tries everything out. 


Interestingly, today it is often not the government which collects data. Instead, the government has private companies do the collecting, take telecommunications for example, but reserves the right to access the information.

Rieger: This is a new pattern that we are observing everywhere. That is why in our book we say that differentiating between the state and business is irrelevant on this point. The cumulative effects that result, that companies collect data and the government has relatively easy access to the information – sometimes forcing companies to collect more than they want to – this is the real problem.

*

Joachim Güntner is the Germany correspondent for the Neue Zürcher Zeitung.

This article was originally published in the Neue Zürcher Zeitung on October 14, 2011.

Translation: ls