Surveillance plans and the growing privacy movement in Germany

There are some very interesting developments in Germany at the moment. First the bad news (the rise of the surveillance state), then the good news (the rise of an anti-surveillance movement):

Data retention and more surveillance plans

The German government has endorsed the draft bill on telecommunications data retention two days ago. This project, implementing a EU directive that is already being challenged at the European Court of Justice, had been under heavy criticism for years. At the same time, the federal minister for the interior, Wolfgang Schäuble, has presented a new "list of horror" (liberal weekly DIE ZEIT). On top of the surveillance apparatus built up in the 1970s and heavily expanded after 9/11, he wants to

• do "preventive" dragnet investigations (i.e. data mining in private databases without suspicion),
• store fingerprints and other biometric data of all Germans who have passports in a networked database,
• use traffic toll data for law enforcement (when the "toll collect" system was started, everybody involved promised that the movement and camera data would never be used for repressive means),
• secretly hack into citizens' computers,
• do "preventive" phone interception,
• eavesdrop into the most private talks of citizens at home,
• use military force with German territory,
• shoot down airplanes that are hijacked by suspected suicide attackers, even when full of passengers,
• connect all databases of the state and federal police and intelligence agencies,
• give the US and others basically unlimited access to passenger data,
• re-establish the "principal witness" regulation (giving freedom to major criminals if they squeal on their former collaborators),
  
• and of course enact the data retention bill which would mandate ISPs and phone companies to store all traffic data of everybody in Germany for 180 days, with the police (after court approval) and intelligence agencies being able to access it.
  

Almost all of these projects have been either turned down by the constitutional court or the European Court of Justice in the past, or there are clear precedents in previous rulings that make clear they are unconstitutional. Because of that, Schäuble wants to change the constitution. This leads us to the good news:

Political resistance and the growing anti-surveillance movement

The working group on data retention, a network of civil liberties organizations and other groups and individuals, has been organizing the resistance over the last year. They had two demonstrations last year which gained little attention and attracted lesst than 300 persons, partly due to short notice planning because of a parliament ruling and other circumstances. But now, the issue seems to have gained enough salience. It is reported on the front pages now, not in the "computer&internet" section where it used to be hidden.

Last saturday, we saw the result: More than 2000 people gathered in Frankfurt on a nice sunny day for the biggest demonstration for privacy since the 1980s. Supporters have been very wide-ranging, from radical anti-fascist groups to the opposition parties and the federation of women's emergency call centers. The ISP associations did not officially support this, but a lot of them helped with logistics behind the scenes. Many of the ISP workers from Frankfurt also took part in the demonstration.

The working group against data retention has also gathered more than 12 000 supporters for a constitutional court challenge against data retention since November. It will be submitted on the day the bill is enacted. This will be the largest constitutional court case in Germany ever.

The adoption of the data retention bill a few days after the demonstration, as well as Schäuble's plans, combined with an unclear statement by him on the presumption of innocence, have led to an outcry in the last few days.

The said-to-be-non-political German blogosphere discussed these developments at a large gathering in Berlin last week and, as a follow-up, has issued a call for creative resistance. Many people had nice ideas. Above all, blog posts that contain "Stasi 2.0" (a reference to East German secret police) with a picture of minister Schäuble are spreading quickly at the moment. Some have taken it to the offline world, too. Examples are here and here. T-Shirts will be available soon.

A pledge to donate 5 Euros per month for the fight against data retention has also attracted a number of people.

Technorati has seen an exponential growth of "Stasi 2.0" in the blogosphere.

For a short while, "Stasi 2.0" even was the most popular search term that came out of the German language space (technorati ranking #13).

This week might be remembered as the moment in history where German bloggers noticed their power for distributed and creative political campaigns. At least, they have found a common enemy now.

Reactions from outside the internet community

The journalists' and publishers' organizations saw the secrecy of their sources under attack by the data retention bill, and most mass media have more or less openly positioned themselves against the plans.

Leading Social Democrats are openly moving away from Schäuble, and some have even compared his attitude to Guantanamo. Even a few prominent conservatives have tried to slow him down (one even said he has to think of Orwell), and the police union has openly questioned the necessity of these measures.

The activist movement is already discussing the next demonstration and setting up local and regional groups. The working group on data retention now calls for chapters and members of the ruling parties SPD, CDU and CSU to sign an open letter against data retention. The "virtual local chapter", the internet branch of the Social Democrats is already supporting it.

It will be crucial how the Social Democrats position themselves in the mid-term. The polls still show support for the current domestic security policy (no questions about recent plans yet), but Schäubles popularity has dropped (from 0.8 to 0.5 on a scale from -5 to +5). With the whole opposition, the majority of the media, large parts of the relevant industry, the churches and most societal groups against surveillance in this debate, it is likely that this will become an even hotter topic and a potential breaking point for the grand coalition in the coming month.

"Privacy and Identity" presentation at re:publica conference

I am in Berlin this week for the re:publica07. My presentation on "Privacy and Identity" last night met a lot of interest, so here are the slides. The video will be made available later at the conference website. (It's in German this time.)

OpenID - next big thing with lots of problems

OpenID is becoming the standard for decentralized identity management and single-sign-on, this was clear after Microsoft announced they would make it interoperable with CardSpace. A short while ago OpenID even made it to the the mainstream press when it was featured on the front page of USA Today's business section. I have looked into it a bit closer now, and I just can say it sucks.

• Your identity provider is able to track all websites you log into. They even tell you it's a feature. User profiling made easy! This reminds me of the data retention plan in Europe, but here it is done voluntarily. Try to think of what can happen if this data falls into the wrong hands?
  
  
  
• You have a unique identifyer (your OpenID uri) for all relying parties, so you can't choose between different cards or identites for different sites. Cross-sites profiling made easy!
  
  
• The latter of course can be worked around if you use many different IDs. But then you run into the usability problems that OpenID was meant to overcome in the first place - having to remember several logins, passwords and so on. The relation between usability and traceability seems to be proportional : If you have only one OpenID, usability is high, but traceability is equally high. If you have many different OpenIDs, you can not be traced across sites, but usability also goes down the drain!
  
  
  
• It is open to the very easy kitten-phishing attack, and eavesdropping is no problem, as the identity tokens are posted through the http "post" command. Who in Web2.0 uses https?

Compared to Microsoft's InfoCard/CardSpace, this is an interesting example of how a big evil monopolist was outfoxed by the crowd / web2.0 community, though the former had the better product and the crowd was naive in believing their A-bloggers. I will be speaking about digital ID management on a few occasions in the coming weeks (here and here), and I look forward to interesting discussions.

Latest news: There is already a campaign against openID in Germany:

The text on the banner means "For Security: OpenID - No, thanks! For Independence". Interesting how some people have understood the surveillance infrastructure that is building up here. Remember Lawrence Lessig: A system of perfect identity is a system of perfect control.

Update, 24 May 2007: The campaign has been taken offline. I am hosting the logo here now for documentation.