German govt proposes law to force WhatsApp Gmail etc to hand over user passwords

I know this is a tradeoff that leaves something on the table, but HN is an English-language site, so articles here need to be in English. We don't allow machine translations as a workaround. I could imagine exceptions for topics of particuar intellectual curiosity—something that is so obscure that it only exists in one form and hasn't been translated. But articles on current affairs are the opposite—in those domains, if a story is important enough to be covered here, it will certainly appear in the English-language media.

Put conversely: in popular domains like current affairs, if there's no English-language article worth submitting on a topic, mostly likely that's because the topic isn't significant enough yet. When it comes to politicians proposing bills, that's certainly the case. Most bills go nowhere (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...), and if anything comes of this one, it will surely receive much closer attention.

For example, in the 80's there was concern about 'bugging' in the UK. But at the time, there was actually informed debate in parliament about the technical details. This could happen because since there was so much labour involved in maintaining the old systems, large numbers of people actually knew how they worked. There were MPs who had formerly been telecom linemen, and followed the trade->union official -> Labour party -> MP route into parliament.

Nowadays I can't think of an MP who would actually have the background to know that this is a bad idea, themselves.

The draft does not provide for an explicit obligation to provide identifiers in plain text. When providing information, however, "all company-internal data sources must be taken into account".

Still far from Merkel calling Zuck und Sundar to hand over the passwords.

Translated to English: https://www.scribd.com/document/439773952/BMJV-GE-Bekampfung...

One of the notable proposed changes is that providers are required to notify federal law enforcement about content that they removed from their platform and which the provider determined to likely violate German laws, including the content and the user's IP address and [source] port number. The intention is to prosecute these cases. There is a provision that requires the user to be notified about this, except if law enforcement specifically requests not to notify the user.

The changes to §15a are very broad and allows a variety of government institutions to request not just customer contract data ("Bestandsdaten", which would be regulated by §14), but also "Nutzungsdaten", i.e. user IDs, IP addresses, logs or similar usage data, even for misdemeanor-level offences. It's a bit of a hyperbole, but to my understanding, this would, in theory, include parking violations and littering, which feels wrong.

Requesting such data was, to my understanding, regulated only superfically by the TMG in §15 (5) with unclear scope. Previous court cases established that this would include IP address data (LG Frankfurt/Main, 2-03 O 174/18). The new paragraph expands on this by explicitly allowing requests to be made using just an IP address (rather than a user identifier), by clarifying the scope to include all usage data, and requiring security measures to be taken to ensure that the data is transmitted securely.

The draft document only mentions about passwords in the comments (page 29), not the actual proposed changes to the law, which only mentions "data which can be used to access storage media on a device".

This is an oddly specific provision that likely targets full disk encryption schemes that have a server-side key backup (i.e. Windows Bitlocker). This was copy-pasted from the existing §113 TKG, which regulates ISPs, and calling these "passwords" is a very unfortunate choice of words by the authors of this draft document.

Disclaimer: Not a lawyer, but I dealt with law enforcement requests in Germany in a past job.