The Collection of Electronic Evidence in Germany: A Spotlight on Recent Legal Developments and Court Rulings

The radical change in telecommunications technologies over the last fifteen years has enabled new techniques to lawfully intercept telecommunications and to gather digital evidence. These include covert remote access to data storages and lawful interception prior to communication encryption by hidden software tools. The specific intrusiveness of these measures, specifically their impact on fundamental rights, have been reflected in the decisions of the German Federal Constitutional Court. In particular, the development of the new fundamental right to integrity and confidentiality of IT systems in the judgment of 27 February 2008 has provided modernized constitutional guarantees, leading to the amendment of the legal framework governing preventive measures. With the judgment of 16 April 2016 on the constitutionality of these new provisions, the Federal Constitutional Court has countered the expansion of investigative powers through laws or their extensive application, developing essential requirements for covert surveillance measures. The German legal system is characterized by a strict and fundamental distinction between preventive measures (such as crime prevention) and investigative measures (such as criminal investigation). The distinction results in different legal competences of (police) authorities and a distinct legal framework following an altered proportionality assessment. As a result, the safeguards, checks and balances for investigative measures need to be at least as high as those for preventive measures, requiring corresponding amendments of the Code of Criminal Procedure. It is therefore surprising to find that the Code of Criminal Procedure (governing investigative measures) has only undergone minor amendments, such as the introduction of § 100i StPO governing the use of International Mobile Subscriber Identity (IMSI) catchers. The use of covert software to intercept telecommunications prior to encryption, conversely, lacks specific rules, albeit the strict requirements laid down for preventive measures in § 20k BKAG a fortiori should apply on investigative measures of the same nature. Only regarding computer-assisted searches, the German Federal Supreme Court has ruled in 2007 that such a measure cannot be based upon the existing legal bases for the lack of adequate safeguards. This lack of modernization of the rules applicable to criminal investigation appears unfortunate, as the measures in question, in the view of the authors, should not be based upon the traditional rules designed for physical wire-tapping of telephone lines. Rather, the specific safeguards laid down in § 20l (2) BKAG, such as the requirement to automatically undo alterations imposed upon the infiltrated system, should be codified for investigative measures, as well as to maintain a comparable level of protection of fundamental rights. However, currently there are no signs that the legislator intends to take any steps to amend the corresponding legal framework for investigative measures.