Bavaria’s police should in future be able to access an extensive network of a suspect’s private information. Other states are also interested. Data protectionists criticize the software from the controversial manufacturer Palantir Technologies.
One name, one click, one network: If experts from the State Criminal Police Office in Bavaria are investigating a serious crime, they should be able to find everything the police know about the suspect in just a few seconds. Car accidents, address, parents, previous crimes: The cross-procedural research and analysis system (VeRA) is intended to search through all police data and display connections as a network. So far, the investigators have had to do this themselves because of the different data formats, sometimes with a printer, paper or needle and thread on the pinboards, which are also known from the ARD crime series “Tatort”. This wastes valuable time.
However, it will be at least until the beginning of next year before the VeRA searches in Bavaria for the first time. Because data protectionists are alarmed about the new police program – and the state government wants to make sure that the provider of the software, which costs five million euros, cannot divert any of the sensitive data.
VeRA: Other federal states are also interested
The program could also be used in other states and at federal level through a purchase option in the contract. Baden-Württemberg and Bremen are considering a purchase, Hamburg is interested. Mecklenburg-Western Pomerania does not want to rule out an acquisition. Hesse and North Rhine-Westphalia are already using similar software from the same provider (Hessendata and DAR) under different names.
By the end of the year, however, the Fraunhofer Institute for Secure Information Technology in Darmstadt, Hesse, should first check the program’s source code. “This is not a normal procedure,” says Michael Lutz, the VeRA project manager in the Bavarian Ministry of the Interior. “We wouldn’t have to do that. But the program will only go into operation when we’ve done everything humanly possible to prevent data leakage.”
Manufacturer Palantir Technologies raises questions
There are two reasons for the skepticism towards the provider, Palantir Technologies GmbH. As a start-up, the company’s US parent company received money from the US foreign intelligence agency CIA, which later became one of Palantir’s customers. In addition, the company, named after the seeing stones in the “Lord of the Rings” trilogy, was founded by controversial tech billionaire Peter Thiel. He, in turn, co-financed the election campaign of ex-President Donald Trump and other US politicians, some of whom are far-right.
In the past, the current Federal Minister of the Interior, Nancy Faeser, had criticized a Palantir order – at the time as deputy leader of the SPD parliamentary group in Hesse. A spokeswoman for the Ministry of the Interior did not answer the question of whether this attitude had changed. It is “not yet decided” whether the Federal Criminal Police Office and customs want to buy the new Palantir program. Countries such as Rhineland-Palatinate, Lower Saxony and Brandenburg, on the other hand, have made it clear that they will not make a purchase for the time being.
Fears, such as those expressed by the Left Party’s domestic policy spokeswoman, Martina Renner, that Palantir could use the program to divert data to the USA are “in the area of myth-making,” emphasizes VeRA project manager Lutz. After all, the company earns its money, among other things, by processing data for security authorities. Leaks would make this business model impossible.
Use requires a change in the law
According to the top data protection officer in Bavaria, the use of VeRA also requires a change in the law. “On the basis of the applicable law, this is not possible,” says the state commissioner for data protection, Thomas Petri. “This is a significant encroachment on fundamental rights. The legislature has to legitimize it.”
He fears that VeRA will access large amounts of data that have never been collected for this purpose. The Federal Constitutional Court has stipulated that the police may only use data collected for a specific purpose for this purpose.
“This software is suitable for overriding this principle of earmarking,” says Petri. “The legislature must ensure that the software is only used in existential emergencies – for example through a judge’s reservation.” Otherwise, VeRA could at some point also automatically read data from car accidents during investigations after burglaries so that the police can investigate more quickly.
Bavaria’s police only want to use VeRA for serious crime
According to the Bavarian Ministry of the Interior, VeRA should only be used in investigations into serious crime – for example terrorism and murder, but also gang theft and child pornography. This means that there is regularly a valid reason to use the data for another purpose.
Investigators should then not only be able to search for connections between suspects, but “if the legal requirements are met” also for data and networks of “victims, witnesses and other participants”.
Hesse and North Rhine-Westphalia, where the police are already using Palantir software for investigations, have changed their laws for use, according to Petri. “But I made it clear that these changes are not enough for me,” emphasizes Petri.
After the contract was awarded to Palantir, Bavaria’s Minister of the Interior, Joachim Herrmann (CSU), announced that VeRA would only be used once the state parliament’s Interior Committee had “expressly agreed”. However, a change in the law would have to be decided in plenary.
In any case, the Ministry of the Interior in Munich is of the opinion that data protection is guaranteed at VeRA. The investigators would have to enter the legal basis on which they use the software for each request, says project supervisor Lutz. “It will all be logged.”
The investigators now urgently need the software in order to be able to investigate terrorist attacks quickly, emphasizes Lutz. “We’ve reached the point where we can’t get any further with the databases.” But it is about information that the police already have access to anyway. VeRA should evaluate them more quickly, says Lutz. “People expect us to know what we know.”