A new German law will allow intel agencies access to all citizens' ID photos. In combination with facial recognition surveillance technology, this means agents will be able to identify people in crowds, warn critics.
Data protection experts, lawyers, and opposition politicians lined up in the German parliament this week to comment on a new law that will give security forces direct access to citizens' ID photos - and create a "de facto national image database," according to critics.
The new electronic ID law (eID), introduced by the government in February and discussed this week in a parliamentary hearing, will not only create a new state-run online ID service, but also give police automatic access to German citizens' data to prevent perceived dangers - and not just when they suspect crimes. Germany's intelligence agencies - domestic, foreign, and the military intelligence agency MAD - will also have access to the images.
Critics in the opposition
The Green party's internet policy spokesman Konstantin von Notz was one of the law's more vociferous critics during the hearing, arguing that it would give intelligence agencies the power to create their own databases of images without anyone knowing.
"The hammer to civil rights, carefully hidden on the back pages of the law, is the introduction of unconditional automated passport and personal ID checks throughout all German secret services," the parliamentarian said in a statement emailed to DW. "This is no less than the open introduction of a nationwide biometric picture database of all German citizens."
This was particularly galling, von Notz added, at a time when "scandals have shown us again and again that we still lack the necessary legal control over the [secret] services."
A noose and a cuckoo's egg
Frank Herrmann, privacy spokesman of the German Pirate Party, agreed, arguing that giving access to spy agencies - essentially a national security measure - was being smuggled into a law that was mainly supposed to be about updating ID card infrastructure. It was, he said, a kind of "cuckoo's egg," a reference to a famous 1989 book detailing a real-life hacking of US government computer systems.
Not only that, since the German government is about to start testing facial recognition software in conjunction with video surveillance in major railway stations, Herrmann argued that the fact that intelligence agencies will theoretically have access to a database of biometrically recognizable images of all German citizens is a "big step to what we generally call a surveillance state." "For me it's like a noose that's slowly being tightened," he told DW.
"To be able to recognize the faces of people in the train stations, I need to have a picture to compare it to," Herrmann explained.
"The cameras in the railway stations identify a face, recognize its characteristics - eyes, mouth, nose, shape - and then the biometric ID pictures from the local authorities provide a picture to compare it to. And then the computer has a name - an official name. That's technologically already possible, and it would be legally possible with this law."
A constitutional hurdle
Germans are legally required to carry a state-issued ID card, but the data on it, including an image, is kept with local district registration authorities rather than in a central nationwide database. But since the police can already access the data centrally if they suspect a crime, some argue Germany already has such a database.
Bernd Holznagel, a Münster law professor who specializes in IT law and spoke at this week's public hearing in the Bundestag, saw this as the main sticking point in the new law.
"The problem is that the lawmakers themselves say that a national database shouldn't be made," he told DW. "That's for data protection reasons - they don't want a central database, they want local ones, to decentralize the power."
This could, Holznagel suggested, lead to a constitutional problem. "The Constitutional Court has always had trouble permitting such central databases, because it could lead to a very far-reaching surveillance of citizens," he said.
"But there are a lot of questions about how it would function practically, which would all have to be answered before you said for sure that it was unconstitutional."
In general, Holznagel argued, Germany has among the highest data protection standards in the world.
A new infrastructure
In fact, Holznagel was broadly in favor of the government's eID reform - not least because it offered a state identification process that was independent of online Facebook or Google profiles. "I think it's important that we have a secure identification procedure," he said. "If you register your car, or if you move house and register your new home, you can't trust some procedure where you just type in your Facebook name and then it's authenticated - none of that is secure. This is an attempt to set up an infrastructure like that, and I think that's very good."
He also said he didn't understand the objections to the sharing of images, seeing as Google was already storing images of people online. "But there's a very big difference," countered Herrmann. "The pictures in the registration offices are official documents. With Google I never know for sure if the name and picture go together. Not only that, all the images on ID cards are biometric photos - that means they can be identified by computer software."