German State Government Accused of Spying on Citizens
BY Antonella Napolitano | Friday, October 21 2011
The Chaos Computer Club, the largest group of activist hackers in Europe, released a report (in German) of the analysis they conducted on a backdoor Trojan allegedly used by the German police of the state of Bavaria during investigations in order to capture VoIP and IM communication on a suspect's PC.
While the German Government is permitted to conduct some forms of “source wiretapping” (Quellen-TKÜ), this software, which can be installed on a person's computer through an e-mail, would seem to go further.
The CCC group explained their findings in a blogpost:
The CCC analysis reveals functionality in the "Bundestrojaner light" (Bundestrojaner meaning "federal trojan" and is the colloquial German term for the original government malware concept) concealed as "Quellen-TKÜ" that go much further than to just observe and intercept internet based telecommunication, and thus violates the terms set by the constitutional court. The trojan can, for example, receive uploads of arbitrary programs from the Internet and execute them remotely. This means, an "upgrade path" from Quellen-TKÜ to the full Bundestrojaner's functionality is built-in right from the start. Activation of the computer's hardware like microphone or camera can be used for room surveillance.
[...] The government malware can, unchecked by a judge, load extensions by remote control, to use the trojan for other functions, including but not limited to eavesdropping. This complete control over the infected PC – owing to the poor craftsmanship that went into this trojan – is open not just to the agency that put it there, but to everyone. It could even be used to upload falsified "evidence" against the PC's owner, or to delete files, which puts the whole rationale for this method of investigation into question.
Responding on the issue, the Bavarian Interior Minister declared in a press release: "According to the 2008 decision of the Federal Constitutional Court on online search, a Quellen-TKÜ ( "source wiretapping") is permitted if the surveillance is restricted solely to data from an ongoing telecommunication process and this is has to be enforced by technical and legal requirements. Nothing else has been practiced in Bavaria before".
The press release also says that it could not be confirmed whether CCC analyzed a test version from the development phase or the latest version of the software.
Techzine ZDnet notes that this is not the first time that a government has been accused of using sofware to spy on citizens. But, if the wiretapping abuse was confirmed, this will certainly have even more impact considering that the German government has always been on the forefront when it comes to protecting its citizens' privacy.
While pushing for a significant increase of security controls, the CCC group strongly argues that a new definition of privacy is now much needed:
The legislator should put an end to the ever growing expansion of computer spying that has been getting out of hand in recent years, and finally come up with an unambiguous definition for the digital privacy sphere and with a way to protect it effectively. Unfortunately, for too long the legislator has been guided by demands for technical surveillance, not by values like freedom or the question of how to protect our values in a digital world. It is now obvious that he is no longer able to oversee the technology, let alone control it.