German spies to access citizens' ID photos

Data protection experts, lawyers, and opposition politicians lined up in the German parliament this week to comment on a new law that will give security forces direct access to citizens' ID photos - and create a "de facto national image database," according to critics.

The new electronic ID law (eID), introduced by the government in February and discussed this week in a parliamentary hearing, will not only create a new state-run online ID service, but also give police automatic access to German citizens' data to prevent perceived dangers - and not just when they suspect crimes. Germany's intelligence agencies - domestic, foreign, and the military intelligence agency MAD - will also have access to the images.

Read more: German intellegence agencies monitored police, journalists worldwide

Critics in the opposition

The Green party's internet policy spokesman Konstantin von Notz was one of the law's more vociferous critics during the hearing, arguing that it would give intelligence agencies the power to create their own databases of images without anyone knowing.

Read more: German parliament greenlights increased surveillance measures

"The hammer to civil rights, carefully hidden on the back pages of the law, is the introduction of unconditional automated passport and personal ID checks throughout all German secret services," the parliamentarian said in a statement emailed to DW. "This is no less than the open introduction of a nationwide biometric picture database of all German citizens."

This was particularly galling, von Notz added, at a time when "scandals have shown us again and again that we still lack the necessary legal control over the [secret] services."

Read more: Questions surround German government's refuge phone surveillance law

A noose and a cuckoo's egg

Frank Herrmann, privacy spokesman of the German Pirate Party, agreed, arguing that giving access to spy agencies - essentially a national security measure - was being smuggled into a law that was mainly supposed to be about updating ID card infrastructure. It was, he said, a kind of "cuckoo's egg," a reference to a famous 1989 book detailing a real-life hacking of US government computer systems.

Not only that, since the German government is about to start testing facial recognition software in conjunction with video surveillance in major railway stations, Herrmann argued that the fact that intelligence agencies will theoretically have access to a database of biometrically recognizable images of all German citizens is a "big step to what we generally call a surveillance state." "For me it's like a noose that's slowly being tightened," he told DW.

"To be able to recognize the faces of people in the train stations, I need to have a picture to compare it to," Herrmann explained.

"The cameras in the railway stations identify a face, recognize its characteristics - eyes, mouth, nose, shape - and then the biometric ID pictures from the local authorities provide a picture to compare it to. And then the computer has a name - an official name. That's technologically already possible, and it would be legally possible with this law."

A constitutional hurdle

Germans are legally required to carry a state-issued ID card, but the data on it, including an image, is kept with local district registration authorities rather than in a central nationwide database. But since the police can already access the data centrally if they suspect a crime, some argue Germany already has such a database.

Bernd Holznagel, a Münster law professor who specializes in IT law and spoke at this week's public hearing in the Bundestag, saw this as the main sticking point in the new law.

"The problem is that the lawmakers themselves say that a national database shouldn't be made," he told DW. "That's for data protection reasons - they don't want a central database, they want local ones, to decentralize the power."

This could, Holznagel suggested, lead to a constitutional problem. "The Constitutional Court has always had trouble permitting such central databases, because it could lead to a very far-reaching surveillance of citizens," he said.

"But there are a lot of questions about how it would function practically, which would all have to be answered before you said for sure that it was unconstitutional."

In general, Holznagel argued, Germany has among the highest data protection standards in the world.

A new infrastructure

In fact, Holznagel was broadly in favor of the government's eID reform - not least because it offered a state identification process that was independent of online Facebook or Google profiles. "I think it's important that we have a secure identification procedure," he said. "If you register your car, or if you move house and register your new home, you can't trust some procedure where you just type in your Facebook name and then it's authenticated - none of that is secure. This is an attempt to set up an infrastructure like that, and I think that's very good."

He also said he didn't understand the objections to the sharing of images, seeing as Google was already storing images of people online. "But there's a very big difference," countered Herrmann. "The pictures in the registration offices are official documents. With Google I never know for sure if the name and picture go together. Not only that, all the images on ID cards are biometric photos - that means they can be identified by computer software."

Read more: How Berlin Christmas Market terrorist Anis Amri eluded German security