Germany’s Prosecutor Rolls Up His Sleeves On NSA Surveillance

A few weeks ago, Ben posted some comments about a Der Spiegel article that suggested the tensions between the United States and Germany were likely to die down. Not so fast, it appears. Germany’s top prosecutor has announced that he is opening an investigation into the alleged tapping of Chancellor Angela Merkel’s cell phone. A statement from the prosecutor’s office indicated that any charges filed would likely come under Article 99 of the German penal code, which states in relevant part, “Those who carry out secret service activities for a foreign power against the German state are subject to up to five years or in extreme cases up to 10 years in prison.” Amid our heavy focus on possible changes to U.S. surveillance laws and policies, it is easy to forget that foreign surveillance quite often violates the domestic laws – including the criminal laws – of the state subject to that surveillance. Indeed, states parties to the COE Cybercrime Convention have an obligation to enact laws criminalizing access to a computer system without right and the technical interception without right of non-public transmissions of data within a computer system. States may have similar laws on the books regarding the tapping of telecommunications services, or laws that more generally prohibit espionage. (For the United States, see, e.g., 18 U.S.C. sec. 794.) Many thought that Germany was not going to proceed with an investigation, both because it would be politically detrimental to U.S.-German relations and because the prospects of a successful prosecution would be low. Indeed, several days before the prosecutor’s announcement, newspapers reported that he would drop the investigation. Yet he seems to have support to proceed from the German government, including the Justice Ministry (which has the authority to instruct the prosecutor). The prosecutor actually has had two “monitoring processes” under way since last year: one focused on mass surveillance by the NSA of German citizens’ data, and one focused on the allegations that the United States had tapped Merkel’s cell phone. He has concluded that there are not sufficient reasons to open an investigation into the mass spying allegation, though he has reserved the right to initiate further investigations about that allegation in the future. Privacy advocates are criticizing him for not pursuing the mass surveillance issue, suggesting that his decision renders some (i.e., Merkel) more equal than others (i.e., the German citizenry). A few reactions: First, news reports suggest that the prosecutor is drawing a distinction between bulk surveillance and targeted surveillance in considering whether there may have been a criminal violation. As the Guardian put it:

The key issue for the prosecution will be to establish whether the NSA monitored the German chancellor's mobile automatically or by default, as the US government has so far implied, or whether individual agents were actively engaged in tapping her calls, as German tabloid Bild claims on Thursday. The latter would constitute a clear breach of German law on German soil according to [article] 99 of the German criminal code.

But it’s not clear why the second action would violate article 99 while the first action would not. Why draw a line depending on whether an individual selected someone’s phone to be tapped and monitored or whether the phone line was selected on the basis of a computer algorithm indicating that a particular phone number warranted surveillance? (It’s not even clear that this accurately captures how NSA engages in telephonic surveillance.) In both cases, some government official has made a decision to surveil that phone line, whether it’s back at NSA headquarters or in Embassy Berlin. Maybe this line drawing is purely practical: to make a criminal case one needs an individual defendant, not a faceless bureaucracy, and it’s easier to identify people who might be working at U.S. Embassy Berlin than those back at NSA. Further, the prosecutor apparently wasn’t able to get any traction within Germany’s own intelligence agencies that would have helped him in his “bulk collection” inquiry, so he stopped. So while there may be practical (and other) hurdles to investigating bulk collection by foreign governments, drawing legal lines that are contingent on how “close” someone is to the surveillance seems harder to defend. I am no expert in German law, and would welcome thoughts about this from readers who are. Second, it will be interesting to see how the investigation proceeds in terms of the prosecutor’s ability to identify particular individuals as being involved in the alleged surveillance. In the Abu Omar case, in which the CIA allegedly rendered an Egyptian sheikh from the streets of Milan, Italian prosecutors ultimately identified 26 U.S. intelligence and defense officers and tried them in absentia. Twenty three were convicted. At this point, the German prosecutor is proceeding against “unnamed” members of U.S. intelligence services; presumably a large part of his investigation will focus on uncovering the identities of those who might have been involved in collecting content from Merkel’s cell phone. Lurking in the background is the prospect of diplomatic immunity: if any of the individuals who end up as possible defendants were accredited to U.S. Embassy Berlin as diplomats, the United States presumably would invoke their diplomatic immunity against prosecution under the Vienna Convention on Diplomatic Relations. Third, this investigation is not the only legal case underway in Europe related to surveillance. In France, two rights groups lodged a complaint in French court, asking the court to open a lawsuit against the NSA, FBI, and seven U.S. firms alleged to have facilitated NSA surveillance against French citizens. A prosecutor will decide whether to open an investigation, and if he declines to do so, the plaintiffs may ask an investigating magistrate to do so. In the UK, Amnesty International filed a complaint against the UK government, alleging that GCHQ unlawfully accessed AI’s communications by virtue of its use of the Tempora program. AI filed its suit with the Investigatory Powers Tribunal, claiming that GCHQ’s surveillance violated Articles 8 and 10 of the Human Rights Act of 1998 (which govern the rights of privacy and free expression). Three other challenges are pending against the GCHQ as well. If the plaintiffs lose, they presumably will appeal to the European Court of Human Rights (ECtHR). Other plaintiffs have brought a case directly to the ECtHR. In that case, the ECtHR is being asked to consider whether GCHQ’s surveillance violates ECHR article 8, which contains a right to privacy, subject to interference for several listed reasons. The UK’s response was due at the beginning of May, though I have not been able to find it. If the ECtHR were to conclude that certain types of surveillance violate the ECHR, all COE states parties (at least theoretically) would have to cease such surveillance to bring their behavior into compliance with a binding interpretation of the Convention. These cases harken back to what took place in the wake of U.S. revelations about its use of extra-judicial renditions and secret detention facilities after the September 11 attacks. There, foreign plaintiffs used foreign tribunals in an effort to pressure their own governments to influence U.S. policy and to obtain information that could be useful in bringing cases in U.S. courts. While the affected European states fought the civil cases in court, the existence of these cases strained the state’s relationship with the United States and complicated the activities of the state’s own intelligence services. Criminal cases such as the Abu Omar case imposed significant transaction costs, requiring U.S. officials to devote large amounts of time to determine how to handle the cases, including whether to invoke diplomatic immunity for the defendants, and to negotiate with the host state’s executive branch regarding the U.S. officials’ defense. In the end, no one foreign case was responsible for shifts in U.S. rendition and secret detention policies, but each contributed to the atmospheric pressure on the United States to alter its way of doing business. We’ll see if these current cases have a similar effect on U.S. surveillance policy. Fourth, these types of cases constitute just one of several important and converging pressures on the United States and other Western states to take additional steps to regulate foreign surveillance more robustly. I hope to say more about these pressures, and the role that international law should play in addressing those pressures, in future posts.