Limited power to eavesdrop contrasts painfully with UK’s far-ranging Snooper’s Charter.
German police are now permitted to infect a suspect’s computers, and mobile devices with special trojan software to monitor communications made with the systems, the country’s interior ministry has confirmed.
The malware can only be deployed when lives are at risk, or the state is threatened, and will require a court order to allow police officers to infect the machines of alleged criminals.
However, the government-developed malware must not be used to monitor other activities on the system, or to change data or programs. It follows a decision by Germany’s Constitutional Court in 2008, which ruled that the an individual’s private life should have absolute protection, and that eavesdropping must be limited to a person’s communications with the outside world.
But Frank Rieger, a spokesperson from the famous Chaos Computer Club (CCC), has cast doubt on the German government’s pledge to adhere to those standards with its trojan software. In an an article on the Deutschlandfunk website (in German), Rieger noted that it was very hard to create malware that can be used to monitor communications in a way that does not infringe on the protected private sphere.
The CCC has been tracking Germany’s authorised malware for some years now.
Back in 2011, the hacker association analysed a previous trojan used and written by the German police and found that: “The malware can not only siphon away intimate data but also offers a remote control or backdoor functionality for uploading and executing arbitrary other programs.”
Even worse, CCC reported at the time that “significant design and implementation flaws make all of the functionality available to anyone on the Internet.” This, of course, remains the fundamental problem with any such “official” malware: once a vulnerability has been created in a system, there is always the risk that others will find and exploit it too.
It’s possible that the fear that the home-grown trojan may not be good enough to survive a court challenge is behind the German government’s consideration of commercial spyware from the controversial Gamma Group, whose products have been used around the world, notably byrepressive governments against political activists.
The Deutschlandfunk report also quoted a politician from the Green party, who pointed out that—whichever trojan software was chosen—the use by the German government of program flaws in order to insert the police malware on a suspect’s computer was inherently problematic. Arguably, instead of helping to improve security for the millions of Germans likely to be affected by a serious bug, the authorities could leave it unpatched so that they can exploit the flaw for their trojan.
Moreover, as noted by Rieger, once those bugs are eventually fixed, the German authorities will need to find other vulnerabilities to exploit, and may even start bidding for them in one of the dodgy zero-day marketplaces.
The legal constraints on the use of government malware imposed by the German’s Constitutional Court contrast painfully with the UK government’s proposals in its draft Investigatory Powers Bill, dubbed a Snooper’s Charter, which seeks to give the police and intelligence agencies unlimited and secret “equipment interference” powers to break into systems, change software there, and spy on everything the user does.
Source:http://arstechnica.co.uk/
