Federal Justice Minister Marco Buschmann of the FDP is taking concrete steps to move forward with the Quick Freeze method for securing connection and location data for criminal investigations. After years of delays, he has introduced a new draft for a "Security Order for Traffic Data in the Code of Criminal Procedure" (StPO) to be reviewed by other federal ministries. An initial attempt was made in the autumn of 2022. Since a fundamental agreement was reached within the executive on this principle in April, adjustments have been made, according to the Federal Ministry of Justice (BMJ).

Focus on Limited Data Storage

The draft document proposes adding a new paragraph to Section 100g of the StPO. It states that traffic data can be secured on a case-by-case basis for the investigation of "serious crimes" if it is relevant for investigating the facts or locating a suspect. A judge's order is usually required to enact these measures. This approach is intended to limit the amount of data stored to what is necessary. It means only the data that telecom service providers already store for operational purposes or will store in the future can be frozen. Messenger services will not be required to secure connection and location data.

Comprehensive Crime Catalog

Quick Freeze applies when there is specific suspicion that someone has committed, or participated in, a crime of significant importance, particularly those listed in Section 100a, paragraph 2. The catalog includes crimes such as murder, manslaughter, robbery, extortion, organized theft, certain forms of money laundering, computer fraud, tax evasion, drug offenses, and sexual abuse of children, along with related dissemination and possession of material. The language includes provisions for securing victim data as well.

Stringent Conditions for Location Data

Heightened requirements are set forth for collecting stored location data: the crime must be "serious in itself" and the "investigation or location of the suspect must be significantly impeded or impossible by other means." Otherwise, only future location information can be gathered, potentially in real-time. Traffic data can be frozen if there is suspicion of crime committed via telecommunication and no other investigative approaches are available.

Gathering of User Data

Under similar conditions, usage data that pertain to communication content may also be collected. The BMJ sees no need for additional regulations, such as a "login trap" for collecting an IP address during the next use of a telemedia service to identify the user. IP address collection is already covered under Section 100k of the StPO.

Storage Duration and Legal Limitations

According to the plan, frozen data can be held by law enforcement authorities for future collection and analysis, pending a renewed judicial order ("thawing"). Investigators have one month initially, with up to two extensions of one month each. Authorities and telecom providers will adhere to technical and organizational measures as outlined in the Telecommunications Act (TKG). Cost implications for the private sector and agencies remain undefined.

General, non-specific data retention of all traffic data is not legally feasible due to top court rulings, explains the BMJ. In its place, after years of debate over indiscriminate documentation of user traces, prosecutors are offered a "fundamental rights-friendly and effective" alternative. Nevertheless, the paragraphs on data retention in the StPO remain, at SPD's request, though largely dormant ("dead law").

Debate on Independent IP Address Storage

Federal Interior Minister Nancy Faeser (SPD) pressures, despite governmental agreement and aligning coalition contract, for the provisional storage of IP addresses. The SPD faction intends to "objectively assess" such a step. Buschmann cautions that in light of the European Court of Justice's current rulings, any member state imposing such a mandate on electronic communication service providers must ensure that no precise conclusions about individuals' private lives can be drawn.

Laws must limit duration to what is "absolutely necessary," ensuring robust guarantees against misuse risks for those affected. Without such measures, achieving a high resolution rate for known cases of "distribution of child pornography content" has nonetheless been possible, as per the 2023 police criminal statistics.

This article was based on reporting by Heise Online. The original article can be read here.