The state has repeatedly wasted trust through excessive surveillance. The tracing app now planned, on the other hand, could become a model based on the rule of law.
One of the great unknowns of the Corona crisis is the question of what the world could look like afterwards. Will the world be a better place? And will the state become a better state because it has kept a sense of proportion in the face of an existential threat? Or is everything changing for the worse? Some countries obviously follow the principle that the chances of a crisis should never be missed – and interpret the principle in its cynical version: China is optimizing its digital surveillance system, Israel wants domestic intelligence to collect movement data, in Tunisia police robots are patrolling and drones are flying with thermal cameras.
And Germany? In Germany, a tracing app is to become a digital detection dog for infection chains. The idea behind this is that if the general shutdown is relaxed, you risk more new infections, but you can precisely trace the individual infections using digital technology. Because people have only come to know the use of information technology in their privacy in two ways for decades, namely as a general government data collection or as an expression of the greed of global data octopuses, the first thought was: Take care! Monitoring! The Corona app, which is being developed by a team around the Fraunhofer Institute for Telecommunications, did not initially make a bad impression on the critical guardians of the digital world. But then a momentum of rejection built up, fueled by an open letter from 300 scientists. They sketched a scenario as is known from many examples in which the state says security and means freedom restriction. An app that is supposed to protect health but to expand the surveillance state. A Trojan horse.
Some of the criticism was surely exaggerated, because the tracing project was never about the really bad things. Location data or even identifying information was always excluded. Nevertheless, the government has now made a spectacular turn. She votes for a decentralized approach – and “decentralized” is a friendly word in the world of data protection. The app, which uses Bluetooth to measure distances to other mobile devices, should not only save in pseudonymized and encrypted form. Above all, it should no longer store the collected contacts on a central server – because central memories are more prone to abuse. The decision to move towards data protection even earned the government applause from the Chaos Computer Club.
Of course, many questions are still open. Does the app work technically exactly enough? And do people really go along because the thing is supposed to be voluntary? Or does the forced app end up threatening? And above all, is this just the low-threshold entry into a nasty monitoring tool that records movement profiles? The Leopoldina Academy’s statement, which was so important to the Chancellor, speaks of the “use of voluntarily provided GPS data in combination with contact tracing”. Reason enough to be vigilant.
German Corona app as a model for future developments?
But let’s assume everything comes as promised. Wouldn’t that be an inspiring example of how human protection and data protection can be combined in the digital age? A reasonable, targeted and – in terms of fundamental rights – cautious solution, born at the moment of a global threat that is about nothing less than protecting human lives? While autocrats are shrinking civil rights even more, the motherland of data protection would go through the crisis with the Basic Law under arm. Couldn’t that be proof that Corona can turn the worst, but also the best, out in the States? Certainly, whoever invokes the risks of technology can give many warning examples from abroad. South Korea is a model country for technologically supported corona control, but probably a nightmare for German data protection experts; there, cell phone and credit card data are used cheerfully for virus searches. Or India: There is an app in use that saves names, ages and jobs and continuously sends location data. The list could go on, but there is still no compelling conclusion. It is not technology that violates fundamental rights, but states that do not know a measure and use the moment for surveillance projects.
The question remains whether Germany is good or bad in terms of surveillance. On September 11, 2001, another global threat suddenly entered human consciousness, including life and death. The reaction to Islamist terrorism was really not particularly accurate, and nobody will claim that the states, including Germany, have treated fundamental rights with care. In the first decade after the attacks, the Federal Constitutional Court criticized practically every law with which the then somewhat new information technology was supposed to be used to combat terrorism – search for raster, online search, automated registration of license plates, data retention. The security authorities have nurtured the belief that data protection is the natural enemy of internal security. The trend has by no means weakened in recent years, on the contrary. After the year 2016, which ended with the terrible attack on a Berlin Christmas market, demands for surveillance and data storage began again – for more video cameras in public places, for example, and for facial recognition systems. None of these were truly confidence-building measures, and perhaps security politicians regret some of them. Because trust is what you need most now. If people don’t take part, the Corona app will fail.
Two characteristics of the counterterrorism measures are interesting here. Their principle is excess, they are often broad and non-specific, with extensive interventions in the fundamental rights of those who have nothing to do with terrorism. Why the Constitutional Court repeatedly criticized laws as disproportionate. The data storage, for example, creates a gigantic haystack of communication data in order to find a needle in it afterwards. And without a specific reason – which the European Court of Justice has now declared inadmissible. The Corona app, on the other hand, would be anonymous mini data retention. It only collects the needles at once, and does so locally. So reluctance, at a moment when everyone is suspected of having something to do with the virus. We are all potential threats.
The second characteristic of the fight against terrorism is its irrationality. A few years ago, Peter Schaar, once a federal data protection officer, characterized the security laws after the attack on Breitscheidplatz as follows: “Questions about the suitability of the measures for counterterrorism remained largely unanswered, criticism was wiped off the table.” Shortly afterwards, the decision was made to expand the video surveillance system – which cannot do anything against rushing semi-trailers. It is no different elsewhere. After the suicide bombing on the Nice promenade, France prolonged the state of emergency – a “symbolic act that was more the result of the campaign than the fight against terrorism,” wrote Schaar.
So if the state can learn something from fighting the great, silent danger called Corona to ensure security in other fields, then it is moderation and reason. What is striking about the debates of the past few weeks is that they are highly evidence-based and reason-based (even if the trend is slowly declining). Contagion routes are verified and duplication models are calculated, numbers compared and curves drawn before restrictions on freedom are ordered. Politics is based on empirical principles to the extent that it has already been accused of ceding rule to virologists. On the other hand, anyone who stores masses of movement and communication data, the benefits of which for combating terrorism have hardly ever been precisely evaluated, should follow the broadband motto “Much helps a lot”.
The Corona app could become an example of how, smart and digital, to preserve freedom and protect fundamental rights. This crisis holds an opportunity. The state could try to regain the trust it has put at risk with escalating surveillance powers. “Never miss a good crisis”: In the end, this could also become an optimistic motto.