A court has ruled that the extensive blacking out of a contract between the Federal Criminal Police Office and the company FinFisher was inadmissible under the Freedom of Information Act. As a result, the BKA was forced to publish a large amount of information – such as the purchase price of around 325,600 euros.
Precedent full of secrecy
The fact that the BKA had signed a contract with the company FinFisher was revealed by netzpolitik.org in 2013. The tender text and the award documents were published in 2014, the first contract with the firm the following year. The BKA had only released the relevant information after being sued under the Freedom of Information Act. However, the published documents were largely blacked out and thus unusable by the public for information purposes. In addition to the price, the BKA had also blacked out the company name and the name of the company’s managing director, for example – although this data was already publicly known as a result of netzpolitik.org’s research.
As a result, netzpolitik.org filed another lawsuit against the BKA. It was supported in this by the transparency portal FragDenStaat. The court has now ruled in favor of the two organizations: The BKA as well as a company closely associated with FinFisher, through which the contract had been handled, must pay the costs of the lawsuit as well as the out-of-court costs; the BKA must also reverse a large part of the redactions and thus make significantly more information available to the public.
Price of surveillance software known
The BKA has complied with these demands. In the course of this, among other things, the price of the surveillance software has become known: In total, the BKA has paid about 325,600 euros from taxpayers’ money for the software FinSpy. Furthermore, some interesting details were made public. For example, the BKA initially had the header of the document blacked out: “Classified information – for official use only”. The names of the fourteen annexes to the contract were also blacked out. These provided information about some of the details. One attachment, for example, is titled “FinSpy PC.”
However, some details remain blacked out because the court recognized a legitimate interest in secrecy with regard to them. These include, for example, the name of the BKA person who signed the contract, but also details of services, costs, deadlines and the source code of the software.
Contract already terminated
Meanwhile, the cooperation with FinSpy was not crowned with success. The company had to spend five years revising the surveillance software to bring it into line with the legal requirements for legitimate surveillance. When this process was completed, the software also turned up on the cell phones of Turkish opposition figures, which eventually prompted the BKA to end its cooperation with FinSpy. The company is now said to be insolvent and dissolved.
Even apart from its cooperation with FinSpy, the BKA has previously had severe problems in connection with surveillance software. For example, the police agency programmed its own surveillance software for several years at a cost of around €5.77 million, which was ultimately not used in a single completed case between 2017 and 2020. In addition, there are substantial doubts about the controllability of the use of the software.
