Courage our network

Germany tapped Frankfurt internet exchange for the NSA

This summer, reporting based on documents disclosed by Edward Snowden gave an indication of the extent of German cooperation with NSA surveillance. In particular, Der Spiegel’s reporting drew attention to the involvement of Germany’s BND in the NSA’s corporate partnerships and the agencies’ jointly staffed projects based at Bad Aibling in Bavaria.

Further investigation by Süddeutsche Zeitung in June shed light on what one of those joint projects involved: the tapping of the DE-CIX internet exchange in Frankfurt, the largest in Europe.

DE-CIX_GERMANY_-_Switch_Rack_(6218137120)

This month, based on documents released to Germany’s ongoing parliamentary enquiry into US surveillance activities, Süddeutsche Zeitung together with NDR and WDR have reported that the information transmitted to the NSA included that of German residents. Any mass transfer of Germans’ information would certainly be contrary to that country’s G-10 law governing surveillance.

SDZ reports that Germany’s government was keen to cooperate with US intelligence-gathering in the years after 9/11 and stood to gain a great deal of technical expertise and resources by allowing the Americans access to the DE-CIX exchange. A memorandum of agreement – which has not yet been made public – was concluded in 2002 and sample collection from DE-CIX started the following year.

Eikonal did not provide the NSA with direct access to DE-CIX. Instead, the BND tapped the internet exchange (likely via Deutsche Telekom) and transmitted phone and internet data to the Mangfall Baracks at Bad Aibling for processing and onward transferal. A system called “Dafis” was supposed to filter out domestic internet traffic and phone calls, but at the outset of the operation it was clear that this didn’t work properly. In 2003, a test had shown that only about 95% of domestic data was filtered correctly.

The documents supplied to the Bundestag investigation show that there were many internal misgivings regarding the impossibility of either agency complying with German law during the project’s lifespan. These qualms may well have contributed to the ending of the project in 2008.

Nevertheless, there was little opportunity for those misgivings to be considered by the appropriate oversight bodies. The official Bundestag Control Commission, the G-10 Commission, was never told about Eikonal, and responses given to German parliamentarians as late as this year appear to have been misleading.

While the Investigation Committee’s hearings are ongoing, it is unclear to what extent it is possible to hold individuals responsible for what appears to have been a clear breach of German law and abuse of established process. The President of the German bar association has said that the affair could be grounds for a constitutional case.

Nevertheless, while the official who authorised Eikonal, Frank-Walter Steinmeier, is now Germany’s Foreign Minister, the statute of limitations on any infractions committed in his individual role has now expired.