Home Office to allow data purchases in grey area

Germany’s federal interior ministry has submitted a draft for a sweeping reform of its intelligence agencies, granting them expanded powers in areas such as state hacking, artificial intelligence, and video surveillance. The proposed changes would significantly enhance the capabilities of the Federal Office for Constitutional Protection (BfV) and the Foreign Intelligence Service (BND). However, the document raises concerns over the potential use of commercially traded data, often collected for advertising purposes, for intelligence-gathering activities. The term “ADINT,” short for Advertising-Based Intelligence, appears in the explanatory notes of the new BND law. It refers to the practice of using data gathered through commercial channels, typically for marketing, to support intelligence operations. Experts suggest this inclusion implies that German intelligence services might already be utilizing ADINT, despite lacking a clear legal basis for doing so. Research conducted by netzpolitik.org and the Bavarian Broadcasting Corporation since 2024 has revealed that location data obtained from the advertising industry can be used to monitor high-ranking officials within the German government and the European Commission, as well as NATO military bases and even employees of intelligence agencies. This form of surveillance has long been known to be practiced by U.S. agencies such as the FBI and the immigration enforcement agency ICE. Recent investigations have also uncovered that Hungary and Austria have purchased products from an ADINT service provider. Whether the use of ADINT data by German intelligence agencies is lawful remains contentious. A report by the Parliamentary Research Service cast doubt on the legality of such practices. Additionally, the Federal Data Protection Commissioner, Louisa Specht-Riemenschneider, and other experts have emphasized that explicit legal provisions are necessary for the acquisition and use of such data. Governmental entities cannot rely solely on broad general clauses that allow them to collect data. Despite these concerns, the current legislative proposal does not provide specific legal grounds for the purchase and use of commercial data, particularly advertising databases, by either the BfV or the BND. According to the ministry spokesperson Karsten Füllhaase, the existing legal framework allows for the purchase of data under the general clauses of section 8 of the Federal Constitutional Protection Act and section 5 of the BND Act. These provisions are only slightly modified in the proposed legislation. Nevertheless, the word “ADINT” appears in the draft bill, specifically in the explanations accompanying paragraph 88 of the new BND law. This section outlines the conditions under which the German foreign intelligence service may transfer data to other entities. The text states: “This provision also covers the transmission of purchased data sets, such as extensive advertising data (so-called ADINT data), or data leaks available on the internet.” According to the draft, such data could be automatically and fully transferred to other parties. The implication is clear: if the BND is allowed to transmit such data, it is assumed that they possess it, or at least have the means to acquire it. Mentions of data purchases also appear elsewhere in the justification for the law. The language suggests that the government recognizes the potential utility of acquiring such data, even though there is currently no explicit legal authorization for their procurement or utilization. This ambiguity leaves room for interpretation and raises questions about the extent to which intelligence agencies might operate beyond the boundaries of established legal norms. The absence of clear regulations regarding the purchase of commercial data highlights a gap in the legal framework governing Germany's intelligence community. While the proposed reforms aim to modernize and strengthen the capabilities of the BfV and BND, they also introduce uncertainties around the legality and oversight of intelligence activities involving commercially sourced data. As the debate unfolds, the role of ADINT in Germany’s national security strategy remains a subject of scrutiny among lawmakers, privacy advocates, and civil liberties organizations.