German Constitutional Court Says Unjustified Surveillance Of Foreign Citizens Is Illegal

from the when-it's-up-to-domestic-courts-to-give-AF-about-non-citizens dept

The German government pretended to be bothered by the NSA's spying when the Snowden leaks began, claiming surveillance of overseas allies was somehow a bit too much. It had nothing to say about its own spying, which was roughly aligned with the NSA's "collect it all" attitude. This could be chalked up to "Five Eyes" envy, perhaps. The NSA works with four other countries to hoover up massive amounts of data directly from internet fire hoses located around the world, but Germany has never made the cut.

While the German PM made a lot of noise about being surveilled, Germany's intelligence agencies continued to perform both domestic and foreign surveillance, resulting in legal challenges to the country's surveillance programs. The German Constitution restricts domestic surveillance but doesn't have nearly as much to say about subjecting foreigners to intrusive snooping. Foreigners are usually considered fair game -- non-recipients of protections given to citizens of whatever country does the spying.

One legal challenge dead-ended when a German court decided a service provider couldn't sue on behalf of its spied-upon users. But others continued, and there's good news to report.

The German government must come up with a new law regulating its secret services, after the country's highest court ruled that the current practice of monitoring telecommunications of foreign citizens at will violates constitutionally-enshrined press freedoms and the privacy of communications.

The ruling said that non-Germans were also protected by Germany's constitutional rights, and that the current law lacked special protection for the work of lawyers and journalists. This applied both to the collection and processing of data as well as passing on that data to other intelligence agencies.

The recognition of the extension of domestic rights to foreign citizens is the end result of a lawsuit filed by journalists against the German government. The lawsuit alleged BND's all-encompassing spying made targets out of everyone, including those normally protected by their own countries' laws preventing the surveillance of protected speech.

The German government argued that foreigners are not protected by anything -- not even the rights granted to them by their governments. The Constitutional Court disagreed, finding that allowing the BND (Germany's NSA equivalent) cannot be allowed to unilaterally decide who could be targeted by its surveillance programs. Current "best practices" allow the BND to roll up on the nearest internet trunk to collect everything: communications routed through a Frankfurt interchange that handles data flowing from France, Russia, and the Middle East.

If the government wishes to continue hoovering up everything flowing through Frankfurt (and internet exchanges elsewhere in the country), it will need to to codify the process with some guardrails in place -- guidelines that will hopefully include some respect for the rights of foreign citizens, including journalists, activists, and lawyers who generally cannot be targeted by their own countries.

Now, all everyone has to do is wait. The German government has until 2021 to amend the law. Presumably, the BND will do whatever it can to appeal this decision that extends domestic rights to foreigners. And it will likely delay any modifications as long as possible to allow for maximum snoopage. Bureaucratic delays aside, this ruling sends a message: the stuff that was considered just normal stuff for maximum national security is no longer acceptable. The judicial system in Germany is unwilling to sacrifice foreigners' rights for the surveillance whims of an agency that hasn't shown a compelling reason why it should have access to everything people from other countries talk about.

Filed Under: bnd, collect it all, foreign citizens, germany, surveillance

Court Says German Intelligence Agency Can Continued To Deploy Its Dragnet On World's Largest Internet Hub

from the court:-dump-pipes-shouldn't-worry-about-end-users dept

The post-Snowden effects on Germany's surveillance architecture have been muted. Oversight in the US is a joke, but it's marginally better than what's being offered in other countries. You'd think a country that survived almost-consecutive crushing surveillance states would be a bit more cautious about deploying dragnets. Not so. All evidence points to German surveillance programs flourishing under the lack of effective oversight, limited only by technical prowess rather than concerns for those swept up by them.

Internal investigations prompted by revelations seemed like a step forward, but the government gave German surveillance programs a thumbs up three years later. The information revealed by Snowden and other leakers did give residents and advocates enough ammunition for legal battles, but the German courts haven't really given them anything in return.

David Meyer of ZDNet reports a court has handed a win to Germany's Federal Intelligence Service (BND) in a lawsuit filed by Frankfort's De-Cix, the largest internet hub in the world. The BND has tapped this for years, sweeping up massive amounts of data and communications, and frequently passing this on to surveillance partners around the world. De-Cix was compliant until 2016, when it decided to sue BND for violating German law.

Until a revision to German law last year, the Federal Intelligence Service, Bundesnachrichtendienst or BND, could only inspect up to 20 percent of the traffic flowing through the hub.

That traffic amounts to over 5TB per second of information coming from and going to places all over the world. The 'G10 law' also says the agency can only inspect international communications.

However, De-Cix's 2016 complaint said the BND was scooping up the lot, without any targeting. It also said the agency was illegally monitoring internal German communications as part of those activities, as its filters for emails involving a .de address did not work properly.

Unfortunately, the allegations of illegal spying won't be examined. The court has decided De-Cix cannot bring this lawsuit, which is nominally on behalf of those being illegally spied on (end users). The court says De-Cix just routes traffic, and as such, cannot allege harm.

De-Cix isn't happy with this ruling.

De-Cix said in a statement that it finds it "incomprehensible" that the Leipzig court failed to deal with the BND's alleged violations, as detailed by the exchange. It added that everyone's privacy rights are now solely in the hands of the government's intelligence oversight committee.

German residents shouldn't be happy with it either. What's been shown repeatedly in the wake of the Snowden leaks is that government oversight of surveillance agencies and programs is weak, ineffective, and frequently given little to no information to work with. The powers granted by various national security laws make the problem worse by expanding surveillance powers and reining it whatever's left of their oversight. Recent years have seen some reform efforts put in place, but beyond making hypocritical noise about the NSA's surveillance of German politicians, not much has been done on the legislative front in Germany, other than to codify abusive surveillance to make it more resistant to legal challenges.

Filed Under: bnd, dragnet, germany, surveillance

Court Says German Intelligence Agency Can No Longer Hoard Billions Of Metadata Records

from the collect?-possibly.-dig-through?-no. dept

A two-year legal battle of German intelligence agency metadata collections has ended. And the German Federal Intelligence (BND) agency has lost.

Germany’s foreign intelligence agency (BND) must not store the metadata - such as phone numbers - of international phone calls for the purpose of intelligence analysis, a court rules on Thursday.

[...]

Media freedom organization Reporters Without Borders filed a lawsuit in June 2015 against the BND, saying it had breached the organization’s secrecy and harmed the partners and reporters it worked with.

This is a big decision -- somewhat on par with the revamp of the Section 215 metadata program here in the US that took place following the Snowden leaks. But it might be bigger than that. BND collects over 11 billion records every year. And it shares this haul with the NSA and GCHQ.

This was revealed via documents leaked to German news agency Die Zeit. The BND was grabbing metadata at a rate of 220 million records per day. This is only a small part of the BND's haul, much of which appears to be harvested from internet cables and satellite transmissions.

These revelations caused some problems for the German government, which has generally been careful to keep Stasi comparisons to a minimum. The BND claimed these collections were lawful, but top government officials weren't so sure. This lawsuit appears to have settled the "metadata" question at least.

The end of this legal battle bears some resemblance to Section 215 v. 2.0 here in the US. The Reuters report says the BND will no longer be able to "store" metadata records for intelligence analysis. There appears to be no restraint on collecting records, which likely means the BND will need to approach companies directly to obtain metadata. This means some semblance of targeting will be shoehorned into the BND's collection system and that metadata interception (in bulk) from internet cables is no longer an option.

It's a small win but it's a good one. And I'm sure it surprised the hell out of the intelligence agency. But thanks to Ed Snowden and other leakers, bulk surveillance -- especially the kind that sweeps up domestic data -- is no longer acceptable.

Filed Under: bnd, germany, metadata, privacy

Germany's Spy Agency Walks Away From Three-Year Investigation With Expanded Spy Powers

from the when-getting-to-the-bottom-of-something-means-lightly-scratching-the-surface dept

Netzpolitik -- once on the receiving end of treason charges for reporting on leaked documents -- is marking the end of the so-called "inquiry" into the BND-NSA partnership with a post discussing the inquiry's multiple failures. The German government's investigation into Five Eyes spy efforts was a direct result of leaked Snowden documents, which showed the NSA had spied on the German chancellor.

It failed to uncover much about that particular allegation. By the time this part of the investigation had been dropped, President Obama had already apologized for the NSA doing perfectly normal NSA-type stuff: spying on foreign officials. The committee turned to a broader discussion of surveillance best practices, including the propriety of spying on friends and neighbors. In doing so, it uncovered plenty of illicit and ill-advised spying by its NSA equivalent, BND.

Netzpolitik has a full list of BND's questionable surveillance targets, including friendly foreign officials, journalists, EU officials, the UN, human aid organizations, banks, rating agencies, and a number of American companies. (Do unto others, etc.)

But when it came to actually examining BND's tactics and programs, the committee opted to dwell on legal minutia.

Quite some time was spent on the question of when which sub-division manager in BND knew of which selector and to whom he reported it or why he didn’t and whether someone was present at a meeting in the chancellery on 24th of October 2013 or not or was it the 28th… No wonder sometimes only a dozen people witnessed the public hearings until late at night.

It's a great way to talk around the issues, rather than addressing them. Netzpolitik felt the pain personally, as its reporters attended the public hearings and transcribed all 5.6 million characters of undisturbed bushes idly observing nearby beatings.

This was not entirely the tribunal's fault, however. As soon as it became apparent surveillance partnerships were going to be discussed, BND's Five Eyes partners began issuing ultimatums.

The committee was only allowed to investigate a few discontinued and outdated joint operations between the German spy agency BND and the Five Eyes: Eikonal in Frankfurt and Glotaic. But the name "Glotaic" could not even be spoken, because it includes the partner's name "CIA". Just like operation "Monkeyshoulder", which was planned with British GCHQ. This could not be mentioned at all, as the UK threatened to end any spy cooperation. The committee would be responsible for terrorist attacks, they said.

The committee is now in the process of writing a report that few will see, much less read. A public version will likely be presented, short on specifics and long on assertions of lawful authority and rigorous oversight. It's basically up to leakers to provide the public with the reality of the situation. And much of what the committee managed to uncover has been glossed over... or codified.

The consequences to those revelations amount to the next scandal. Instead of adjusting the spying to the law, the laws are adjusted to the spying. One year before the end of the committee, the grand coalition passed a reform of the BND law. With this change, everything that the BND is doing, is legalized – and even expanded.

The committee found that the NSA spies on its "friends" just as often as BND does. The examination of 14 million shared intercepts turned up 40,000 "friendlies." Notably, the committee was not allowed to review these intercepts. It was just supposed to take the single reviewer's word on the percentage of "friendly" NSA targets.

Taking a look at its own intercepts, BND found 3,300 "participants" linked to 15,000 "selectors" in its "friendlies" file. This means German officials like Merkel will find it difficult to feign anger at the NSA's friendly spy targets.

Not that any of this matters, at least not in the short run. As Netzpolitik points out, while the committee was busy discussing the few things it could discuss, the German parliament was expanding BND's legal authorities.

German citizens -- along with everyone the government spies on -- can rest assured nothing has changed. It's only gotten worse. The final report may provide more examples of BND's misconduct, but the agency has already been rewarded for its misbehavior by the same officials charged with holding the agency accountable for its abuses.

Filed Under: bnd, germany, mass surveillance, nsa, surveillance

Leaked Documents Show German Intelligence Agency Spent Years Spying On Foreign And Domestic Journalists

from the no-oversight,-no-self-control dept

The tools are there to be abused. Anyone who doubts this aspect of intrusive surveillance programs is either a supporter or a beneficiary. Oversight might be in place and various checks and balances instituted, but the scope and breadth of these programs ensures -- at minimum -- collection of communications and data government surveillance agencies have no business looking at.

If someone's given a tool that allows them to snoop on almost anyone with impunity, it will eventually be abused. Case in point: everywhere and everything related to state-sponsored surveillance.

Spiegel, which has published several surveillance agency leaks (from Snowden and others), has obtained some more documents. The documents haven't been published, but the contents indicate that -- from 1999 on -- Germany's foreign intelligence agency (BND) has used its powers to snoop on journalists and their sources.

According to documents seen by SPIEGEL, the BND conducted surveillance on at least 50 [...] telephone numbers, fax numbers and email addresses belonging to journalists or newsrooms around the world in the years following 1999.

Included among them were more than a dozen connections belonging to the BBC, often to the offices of the international World Service. The documents indicate that the German intelligence agency didn't just tap into the phones of BBC correspondents in Afghanistan, but also targeted telephone and fax numbers at BBC headquarters in London.

A phone number belonging to the New York Times in Afghanistan was also on the BND list, as were several mobile and satellite numbers belonging to the news agency Reuters in Afghanistan, Pakistan and Nigeria.

The extent of the surveillance isn't detailed in the article. The writer refers to phones being "tapped" but also states the journalists' numbers were used as "selectors," which possibly means this was limited to data collection, rather than communications.

Not that it possibly being "just metadata" makes it any less of a violation. German law supposedly shelters journalists from domestic surveillance with protections roughly comparable to attorney-client privilege. But the reality of the situation proves the country's laws are only as strong as those enforcing them. Watching the watchers is something no country seems to do well, and Germany is no exception.

This wouldn't be the only time Germany's BND has targeted journalists. It may be the earliest (leaked) record of such behavior, but Spiegel has covered previous leaks in which journalists' emails were intercepted and other journalists were caught in the crossfire of BND's surveillance of allies' government agencies.

This news comes just as a three-year investigation into BND's tactics and surveillance programs wraps up. Not that anything will come of this investigation. During the investigation's running time, leaks continued to highlight inappropriate surveillance, even as Germany's legislators set about codifying BND's previously-illegal snooping. As long as surveillance powers continue to expand and agencies are given a free pass for previous bad behavior, citizens' rights will continue to be violated.

Filed Under: bnd, germany, journalism, surveillance

Leaked Oversight Report Shows Illegal Surveillance, Massive Constitutional Violations By Germany's Intelligence Service

from the the-Snowden-Effect-continues dept

German website Netzpolitik might be headed for another treason investigation. The German government went after the site once for publishing leaked documents detailing mass surveillance operations and it may do so again after its latest publication.

The site has obtained a classified report from the country's intelligence oversight office that shows the BND (Germany's intelligence service) illegally collected and stored data and information obtained via its partnership with the NSA.

The report’s executive summary describes serious violations of the law [emphasis added]:

The BND has illegally and massively restricted my supervision authority on several occasions. A comprehensive and efficient control was not possible.

Contrary to its explicit obligation by law, the BND has created [seven] databases without an establishing order and used them (for many years), thus disregarding fundamental principles of legality. Under current law, the data saved in these databases have to be deleted immediately. They may not be used further.

Although this inspection was only focused on the BND station in Bad Aibling, I found serious legal violations, which are of outstanding importance and concern core areas of the BND’s mission.

The BND has collected personal data without a legal basis and has processed it systematically. The BND’s claim that this information is essential, cannot substitute a missing legal basis. Limitations of fundamental rights always need to be based on law.

German (constitutional) law […] also applies to personal data which the BND has collected abroad and processes domestically. These constitutional restrictions have to be strictly abided by the BND.

Some of what was illegally gathered and stored was obtained via the NSA's XKeyscore program, which harvests email, online chats, and browser histories in bulk. The report notes that the indiscriminate collection of data and communications was subject to very little in the way of minimization, resulting in plenty of non-targets being swept up in the dragnet and their data/communications dumped into the BND's databases.

Because of its […] systematic conception, XKEYSCORE – indisputedly – collects […] also a great number of personal data of irreproachable persons. The BND is not capable of substantiating their number […]. In one case I checked, the ratio was 1:15, i.e. for one target person, personal data of fifteen irreproachable persons were collected and stored, which were – indisputably – not required by the BND to fulfill its tasks […].

The collection and processing of these data are profound violations of [the] BND law.

These infringements of constitutional rights are conducted without any legal basis and thus harm the constitutional right of informational self-determination of irreproachable persons. Furthermore, these infringements of constitutional rights result from the inappropriately – and thus disproportionately – large scale of these measures, i.e. the inappropriately large number of irreproachable persons surveilled […].

Not only did the BND harvest in bulk, but it also passed on this 1:15 collection unminimized to the NSA.

The amazing part of this leaked report is that it only details the violations of a single BND collection outpost. There are seven more in Germany yet to be examined. On top of that, the oversight body couldn't even get a clear picture of the illegal activities occurring at this single station. There were just too many of them.

This "storage and processing of personal metadata in VERAS is subject to the BND law and subsidiarily to the Federal Data Protection Act". But in many aspects the Data Protection Commissioner was hindered from examining the data properly. When requesting only the retained data of individuals protected by fundamental rights, the database had too many be displayed. Thus, she gradually reduced the time frame: "90 days, 30 days, 1 day". Still too many hits:

In none of the these cases, the system was able to display the hits because the number exceeded the limit of 15,002 – not even in the case of the least possible time restriction of one day.

This means the Federal Data Protection Commissioner was not able to examine the contents of the massive meta data retention. Additionally, she was not able to check how the BND used personal data, because: There are no logs.

The BND is neither aware of the kind or the scope of logs, nor was it technologically possible to access the log data of VERAS 6. Further, there existed no technical capability to analyze the logs.

Unfortunately, the violations found by the Data Protection Commissioner have since been codified into law. The BND is harvesting even more than it was when it was inspected, having just finished a 300 million euro revamp of its surveillance tech. Much like here in the US pre-Snowden, the oversight in Germany is relatively toothless. Whatever exists will be actively thwarted by intelligence agencies (the report states that BND deleted logs the Commissioner asked to examine) or by other legislators who are always willing to sacrifice the public's rights for national security.

Filed Under: bnd, germany, leaks, mass surveillance, nsa, privacy, surveillance

German Investigation Into NSA Surveillance Of Angela Merkel Dropped

from the politic,-but-unlikely-to-be-a-popular dept

After the first wave of Snowden revelations two years ago, one of the most dramatic later claims was that the NSA had been monitoring the calls of Germany's Chancellor, Angela Merkel. As Techdirt reported at the time, the US government made things worse by emphasizing that it was not presently monitoring her calls, and promised not to monitor them in the future, while leaving the obvious question about past activity glaringly unanswered. Matters were not improved when President Obama then claimed that he had known nothing about the spying. No wonder, then, that a formal investigation into the allegations was launched by Germany in June 2014.

Since then, things went rather quiet, which makes news that Germany’s chief federal prosecutor is dropping the case because of lack of evidence rather surprising. As Reuters reports:

"The accusations made would not stand up in court with the means available for criminal proceedings," the federal prosecutors office in Karlsruhe said in a statement.

"The vague remarks from U.S. officials about U.S. intelligence surveillance of the chancellor's cell phone -- i.e. 'not any more' -- are insufficient evidence".

However, the official statement from the chief federal prosecutor's office (original in German) did not rule out resuming the investigation if new evidence emerged at a later date.

It is likely that Merkel and her advisers have decided that it is better to mend bridges with Obama in this face-saving way rather than to continue demanding answers from an unresponsive US government. That may be a politically reasonable move, but it is unlikely to satisfy many Germans who saw the allegations as evidence that no one was safe from US (and British) spying.

Moreover, as Techdirt noted back in 2013, the refusal by the US authorities to address these and other allegations of surveillance is contributing to the German public's jaundiced view of the TAFTA/TTIP negotiations, which are increasingly in trouble. That skepticism is reflected by the fact that among the 2 million signatures gathered so far by the pan-European Stop TTIP online petition, fully one half come from Germany. The decision to drop the investigation into claims that the NSA listened in on Merkel's phone calls is unlikely to make things better.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: angela merkel, bnd, nsa, surveillance

Germany's Spies Store 11 Billion Pieces Of Phone Metadata A Year -- And Pass On 6 Billion To The NSA

from the bad-sex dept

Given Germany's high-profile attachment to privacy, it's always interesting to hear about ways in which its spies have been ignoring that tradition. Here, for example, is a story in the German newspaper Die Zeit about the country's foreign intelligence agency BND gathering metadata from millions of phone records every day:

Zeit Online has learned from secret BND documents that five agency locations are involved in gathering huge amounts of metadata. Metadata vacuumed up across the world -- 220 million pieces of it every single day -- flows into BND branch offices in the German towns of Schöningen, Reinhausen, Bad Aibling and Gablingen. There, they are stored for between a week and six months and sorted according to still-unknown criteria.

Exactly where the BND obtains the data remains unclear. The Bundestag [German parliament] committee investigating the NSA spying scandal has uncovered that the German intelligence agency intercepts communications traveling via both satellites and Internet cables. The 220 million metadata are only one part of what is amassed from these eavesdropping activities. It is certain that the metadata only come from "foreign dialed traffic," in other words, from telephone conversations and text messages that are held and sent via mobile telephony and satellites.

As in the US and UK, the German spies attempt to pull the "it's only metadata, so it's not surveillance" trick:

Many people don't realize how much information can be derived from metadata -- and the BND is working hard to keep it that way. For example, during hearings before the Bundestag committee investigating the NSA affair, intelligence officials have consistently spoken about "routine traffic" whenever they have actually meant metadata. Given that the German word for "traffic" is the same as that for "intercourse," this has sounded more like bad sex and has aimed to obscure the fact that hidden behind it was comprehensive, groundless and massive surveillance.

What's more, the officials have argued that they are permitted to vacuum up this kind of routine traffic all over the world without any restrictions and to use it as they see fit. However, Peter Schaar doesn't share this view at all. Instead, the German government's former commissioner for data protection and freedom of information believes that metadata should also be protected by the basic right of privacy of correspondence, posts and telecommunications guaranteed by Article 10 of Germany’s Basic Law.

This long and interesting report is important for the insight it gives us about what the BND is up to -- despite Germany's stringent laws -- as well as the news that the German intelligence service passes 500 million pieces of metadata to the NSA every month. General Michael Hayden, former director of the NSA and the CIA, famously said: "We kill people based on metadata." That means privacy-loving Germany could be implicated in some of those deaths. And there's another aspect to the story worth noting. Nowhere does Die Zeit say that this information comes from Edward Snowden. Once again, it looks as if his example is inspiring others to shine a little light on the murky world of surveillance.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bnd, germany, metadata, nsa, privacy, surveillance

Like The NSA And GCHQ, Germany's Foreign Intelligence Agency Uses A Legal Loophole To Spy On Its Own Citizens

from the well,-fancy-that dept

One of the striking features of the responses to Edward Snowden's leaks about the snooping being carried out by the NSA and GCHQ is the insistence that everything is, of course, quite "legal." But gradually, it has emerged that this "legality" is achieved through the use of loophole after loophole after loophole after loophole. Now it has been revealed that Germany's intelligence agency, the BND, has also been using this trick to enable it to spy on its own citizens -- something that was assumed to be off-limits for it:

The agency, known by its German acronym BND, is not usually allowed to intercept communications made by Germans or German companies, but a former BND lawyer told parliament this week that citizens working abroad for foreign companies were not protected.

The German government confirmed on Saturday that work-related calls or emails were attributed to the employer. As a result, if the employer is foreign, the BND could legally intercept them.

This latest story in the Guardian adds to the impression that widespread domestic surveillance is taking place because of a willful disregarding of the rules through the use of these loopholes. Maybe one way to start to rein in spy agencies would be to insist that they followed the spirit as well as the letter of the law -- and if they don't, to bring in even more stringent definitions of permissible activities in an attempt to close as many of these gaping loopholes as possible.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bnd, loopholes, privacy, surveillance

German Spy Agency Wants To Buy Zero-Day Vulnerabilities In Order To Undermine SSL Security

from the is-that-really-a-good-idea? dept

The newspaper Süddeutsche Zeitung reports that the German spy agency BND will spend €28 million on what it calls its 'Strategic Technical Initiative' (SIT) next year, and that it has asked the German government for a further €300 million (original in German). The German edition of the English-language site "The Local" explains how the money will be used:

The aim of the programme is to penetrate foreign social networks and create an early warning system for cyber attacks.

Government spokesman Steffen Seibert confirmed to dpa on Monday that the BND had worked with French computer security firm Vupen, which is known to sell details of security holes to governments, in the past.

Techdirt has written about Vupen a couple of times recently, and emphasized why buying such zero-day vulnerabilities to use for surveillance purposes without passing them on to be fixed makes the Internet much less safe for everyone. According to a related story in Der Spiegel (original in German), the BND hopes to apply zero-days to undermine the main encryption technology used to protect online communications, the Secure Sockets Layer (SSL) protocol. As The Local writes:

The programme to penetrate SSL, codenamed Nitidezza, would also target the HTTPS protocol which is the standard for many banks, online shops, webmail providers and social networks.

"Holes in SSL need to be patched [fixed] because it is ubiquitous and everyone depends on it for their security," said Jim Killock of London-based digital rights NGO Open Rights Group.

"There is a real risk that failing to fix problems means criminal gangs will seek to obtain the same data using the same defects."

SIT means that not only will the privacy of millions of people be at risk, but so will their economic activities and that of all the companies that use SSL to carry out online transactions.

The BND's move is particularly worrying, since it could well encourage spy agencies in other nations to follow suit, thus starting a bidding war for serious software flaws. That, in its turn, will encourage even more people to find and sell zero-days, rather than report them, reducing security online. It's probably too much to hope that government agencies would ever agree to give up acquiring and using software bugs in this way, but they should at least be required to limit their use so as to minimize the serious harm they could wreak across the entire Internet.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bnd, germany, security, spy agency, ssl, surveillance, zero days
Companies: vupen