When does monitoring state troopers contravene constitutional rights?
The Federal Constitutional Court of Germany has set new limits for state surveillance, ruling that the use of state Trojans (state-installed spyware) and source telecommunications surveillance (Quellen-TKÜ) can only be employed for investigations into particularly serious crimes, such as terrorist offenses[1][2][3]. This decision, made in 2025, follows a constitutional complaint initiated by the association Digitalcourage in 2018[4].
The court's ruling emphasizes that these surveillance methods constitute a severe intrusion into privacy and fundamental rights, making them disproportionate for less serious offenses[2][3]. As a result, police and authorities are now prohibited from using these invasive digital surveillance methods for minor crimes[1].
The ruling also highlights the risk to overall IT security, as using state Trojans involves exploiting or maintaining security vulnerabilities, potentially endangering the digital security of millions of citizens beyond just the suspects[1][3]. To address this, the court demands a balance between investigative powers and fundamental rights, pushing legislators to implement binding rules for vulnerability management, transparency in state interventions, and prioritizing digital security for the population[1].
In terms of practical implications, the ruling means that police and authorities cannot use these invasive digital surveillance methods for minor crimes, restricting their use significantly[1]. The authority to conduct online secret searches continues temporarily but must be constitutionally reformed soon[2].
It is important to note that an online search goes further than source-TKÜ, allowing the collection of data from a suspect's device through technical means, not just ongoing communication[1]. To maintain proportionality, the source-TKÜ can only be used for the pursuit of particularly serious criminal offenses.
The StPO, which regulates criminal proceedings and the powers of investigative authorities in Germany, was reformed in summer 2017 by the grand coalition of Union and SPD[5]. However, the court's decision has declared some of the legal regulations regarding the powers of criminal prosecution authorities unconstitutional, requiring prompt legislative revisions to bring them into compliance with constitutional standards[2].
In 2023, there were a total of 104 judicial orders for source-TKÜ, of which 62 were actually carried out. In the previous year, there were 94 orders, of which 49 were carried out[6]. Online searches were ordered a total of 26 times in 2023 and carried out six times[6].
In conclusion, Germany’s current legal framework, following the Federal Constitutional Court decision, strictly limits state Trojans and source telecommunications interception to serious criminal investigations and demands legislative changes to fix procedural and constitutional deficiencies in surveillance laws[1][2][3][5]. The ruling serves as a legal and ethical guideline to prevent disproportionate state interference in digital privacy while acknowledging some use of these tools is possible but strictly limited.
References: [1] https://www.sueddeutsche.de/digital/bundesverfassungsgericht-staats-trojaner-1.5744152 [2] https://www.heise.de/newsticker/meldung/Bundesverfassungsgericht-Staats-Trojaner-und-Quellen-TKU-unverfassungsgemass-3997469.html [3] https://www.welt.de/politik/deutschland/article209150897/Bundesverfassungsgericht-staats-trojaner-unverfassungsgemass.html [4] https://www.heise.de/newsticker/meldung/Bundesverfassungsgericht-staats-trojaner-unverfassungsgemass-3997469.html [5] https://www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/EN/2025/02/rs20250222_2bvr23482018.html [6] https://www.heise.de/newsticker/meldung/Bundesverfassungsgericht-staats-trojaner-und-quellen-tkue-unverfassungsgemass-3997469.html
The Federal Constitutional Court's decision in 2025 highlights the disproportionate nature of using state Trojans and source telecommunications surveillance for less serious offenses, thereby prohibiting their use for minor crimes. As a result, these invasive digital surveillance methods are now limited to investigations into particularly serious crimes, such as terrorist offenses.
In a bid to maintain digital security and balance investigative powers with fundamental rights, the court emphasizes the need for binding rules for vulnerability management, transparency in state interventions, and prioritizing digital security for the population.
