Federal Criminal Police Office can read WhatsApp

Encrypted communication poses major problems for security authorities. According to research by WDR and BR, however, the BKA has long been able to read chats via WhatsApp - using a regular function.

Only with a very great effort, such as the use of state spy software, the so-called "state Trojan", can encrypted chats be monitored by criminals - or so it has been said so far by the security authorities. Monitoring communications via messenger services such as WhatsApp is one of the biggest challenges for law enforcement, it said. Since the providers of the programs do not allow the authorities to secretly read what is going on, they are in fact forced to use spyware.

 According to research by BR and WDR, however, the German Federal Criminal Police Office (BKA) has been able to monitor communications via WhatsApp for several years now - even without having to install surveillance software on the target's cell phone.

Regular WhatsApp function used

According to the report, the BKA's Information Technology Surveillance Unit (OE 24) has apparently found a way to obtain encrypted WhatsApp chats. "The BKA has a method that can make it possible to trace text, video, image and voice short messages from a WhatsApp account in real time," according to an internal letter from the police department. A target's WhatsApp contacts could also be "made known" in this way.

Apparently, the investigators use for this purpose the possibility that WhatsApp can also be controlled via the Internet browser. This function is called "WhatsApp Web." It is a regular function, as the investigators emphasize in their letter. However, in order to carry out such a measure, law enforcement must have access to the target's cell phone for a short time, and then synchronize the chats with the WhatsApp browser version. Only then can the investigators read along unnoticed.

Amri contact monitored

Evidence of this surveillance method is provided by documents from the Federal Prosecutor General's investigation of terror suspect Magomed-Ali C., a Caucasian Islamist and acquaintance of Breitscheidplatz bomber Anis Amri.

C. allegedly planned a series of bombings together with Amri and a French extremist. Earlier this year, he was sentenced to five years and four months in prison by Berlin's Superior Court for preparing a "serious act of violence endangering the state."

After Amri's attack, the BKA investigated Magomed-Ali C., as it was feared that the Islamist might also carry out a terrorist attack. In the course of this, investigators suggested monitoring the Caucasian's WhatsApp communications as well. "The outlined measure of WhatsApp monitoring is technically possible under certain conditions," a July 30, 2018, BKA memo said.

In the BKA's view, this method is surveillance under Section 100a of the Code of Criminal Procedure - that is, regular telecommunications surveillance with a court order. Although chat histories can also be comprehensively read, this is not surveillance such as the use of the so-called state Trojan.

Method hardly ever used

Upon request, the BKA states that it "does not provide detailed public information on technical or operational investigation capabilities (...) for example in the area of information technology surveillance. According to security sources, the BKA has so far hardly used the WhatsApp surveillance method. They say it can only be implemented with a comparably high effort and is therefore not practicable for many investigative procedures.

In the context of counter-terrorism, surveillance of messenger services may well be justified by judicial order, says the Left Party member of the Bundestag Martina Renner. "But if the BKA really has and uses skills at this point, then I don't understand why there is a cry in the political arena at every circumstance that one must finally be able to read along on WhatsApp," Renner said. "That is then eyewash."

Constitutional protection should get state Trojan

For several years, security authorities and the Federal Ministry of the Interior have been pointing out that it must be possible for investigators to monitor communication channels such as WhatsApp in order to solve serious crimes. The legal framework for this has already been created. Since the reform of the Code of Criminal Procedure in summer 2017, the BKA and the Federal Police have been allowed to use the so-called "state Trojan" to carry out surveillance measures.

Similar powers are also to be given to the Office for the Protection of the Constitution in order to be able to investigate terrorist threats. This is provided for in an amendment to the Constitutional Protection Act at the federal level, which is to be passed after the political summer break.

Comments

Post a Comment

Popular posts from this blog

Chrome targeted by criminals: Why users need to update quickly now

A security vulnerability in Google Chrome is currently being exploited by cyber criminals. Malware could land on your PC through it. Read here how you can protect yourself. The Google Chrome browser is currently struggling with some security vulnerabilities. In a blog post , Google warns about a total of seven vulnerabilities, with the majority of these gaps being classified as a "high" threat to users. The vulnerabilities have been fixed in the latest version of Chrome for Windows, Linux and macOS. If you have Chrome version 90.0.4430.85 installed, it can no longer be exploited. If you have an older version of the browser installed, you should update urgently. You can find the download of the new version below these lines. Smartphone users do not have to be afraid of the security vulnerability. Google has not had to take any security measures here for the time being. The security vulnerability probably remained undiscovered by cyber criminals for the time being. So far, noth...
Read more

Face and voice recognition: Why TikTok wants to be allowed to collect biometric data in the USA

TikTok's privacy policy for the US now mentions the collection of biometric data from faces and voices. The background is likely to be a legal dispute that cost the company $92 million. Neue Datenschutzbestimmungen sind oft eher etwas für Juristen, doch die jüngste Aktualisierung von TikTok sollte alle Nutzerinnen und Nutzer in den USA aufhorchen lassen. Denn in den am 2. Juni aktualisierten Datenschutzbestimmungen für die USA ist ein Abschnitt enthalten, den es zuvor nicht gab. Er lautet übersetzt: »Wir sammeln möglicherweise biometrische Identifikationsmerkmale und biometrische Informationen, wie sie im US-Recht definiert sind, wie etwa von deinem Gesicht und deiner Stimme, aus deinen Inhalten.« Im englischsprachigen Original ist von »faceprint« und »voiceprint« die Rede. »Bevor wir damit anfangen«, frage man jedoch nach dem Einverständnis, wenn dies gesetzlich nötig sei, fügte noch TikTok hinzu. In response to an initial inquiry from "TechCrunch" about the ba...
Read more

Microsoft Teams, Zoom, WebEx: Berlin authority warns against popular video systems

After an initial data protection audit, some video service providers have made improvements to their offerings. But the Berlin data protection commissioner still sees serious shortcomings. The State Commissioner for Data Protection in Berlin (Germany), Maja Smoltczyk, advises against using leading video conferencing systems such as Microsoft Teams, Skype, Zoom, Google Meet, GoToMeeting, Teamviewer and Cisco WebEx. The reason is a retest of various offerings. After a number of services had already failed a test of data protection requirements last year, a new test of the major providers did not reveal any substantial improvement. Smoltczyk said that she was pleased "that our comments had persuaded so many providers to improve their offerings, in some cases very significantly, in terms of data protection". There are now enough legally compliant services for a wide range of purposes that there is no reason to break data protection law for video conferencing. However, if a provid...
Read more