IP addresses | IP catching: A new form of surveillance

In September, Norddeutscher Rundfunk uncovered a previously little-known surveillance method: so-called IP catching. On Tuesday, netzpolitik.org published internal investigation files showing how this technology is used. According to the report, internet access providers are required by authorities to monitor their customers' connections in real time. The goal is to determine who is contacting a specific server.

Police or intelligence agencies can also use this method to identify individuals using anonymous services such as the Tor network, which is distributed across thousands of servers. In the only documented case to date, such a Tor server was monitored at the German internet hosting provider Hetzner. The aim was to identify those responsible for the child pornography platform "Boystown."

The telephone provider Telefónica and its German subsidiaries were required to collect all connections to this server – the so-called traffic data – for three months. The order issued by the Frankfurt am Main Public Prosecutor's Office, which is responsible for internet crimes, was approved by the city's district court. Potentially, all 44 million Telefónica mobile customers were affected.

Many experts interviewed by netzpolitik.org had never heard of "IP catching." The method is not legally defined, the Frankfurt Public Prosecutor's Office confirmed to netzpolitik.org. According to the portal, investigators are citing a 2016 Beck commentary on the law, written by a law professor and former head of department in the Bavarian Ministry of Justice, as the basis for its use.

Other experienced and prominent lawyers, however, believe that IP catching is not covered by any current laws, citing the measure's wide range of potential uses, as millions of innocent people are monitored in order to track down a single individual—in the case of "Boystown." The Society for Civil Rights also considers the paragraph on collecting traffic data to be inadequate.

A lawyer for the organization points out that IP catching also records content. In the documented case, Telefónica was indeed required to record content data from the connections – but according to the court, this data was only stored briefly and immediately deleted. How exactly this works technically remains unclear. Apparently, only the traffic data was transmitted to the authorities.

How often IP catching is used also remains unclear. Deutsche Telekom states that it has not implemented any such measures in the last five years. Vodafone declined to comment, while Telefónica merely confirmed that a court order was necessary. The Frankfurt am Main Public Prosecutor's Office also cannot say how often it has requested such measures, arguing that there is no regulation requiring their use to be recorded.

In response to a parliamentary inquiry, the Federal Ministry of the Interior stated that the Federal Police had not conducted any IP-catching measures in the past five years. It refused to provide any information regarding the Federal Criminal Police Office (BKA), which used IP-catching in the "Boystown" case. The federal government classifies all information about the intelligence services as "secret."

Clara Bünger, the questioner, criticized this response, especially since it constitutes an incalculable infringement of fundamental rights. The Left Party MP called for "a fundamental, fundamental rights-friendly reorganization of the digital intervention powers of law enforcement authorities."

In the "Boystown" case, IP catching was a success: The platform's administrator was identified and sentenced to ten and a half years in prison. Whether the investigation would have been successful without this measure remains open.