Max Planck Institute for Foreign and International Criminal Law

"Encryption and anonymization create prosecution-proof zones with fatal consequences for domestic security," maintains German Federal Police (Bundeskriminalamt) Chief Zierke. This is correct in that a successful anonymization obscures the IP address, which could otherwise be used to identify an actor’s identity. Indeed, both the state and private entities may be capable of identifying users – as the recent Telekom scandal shows. As a result, more and more users who are savvy about data protection are taking steps to conceal their IP address and, consequently, their own identity; they are also taking steps to protect their data by means of encryption. Hence, this project addresses the issue of the functional limits of criminal law, especially the question of whether by means of anonymization and encryption offenders are actually in the position of creating for themselves prosecution-proof zones in the Internet. The territorial limits of criminal law are also addressed, because sophisticated anonymization techniques often make use of transnational structures in order to offer a higher degree of technical as well as of legal security.

This project studies various aspects of anonymity. One focus is on laws that deal with anonymous communication in the Internet; a second is on the technical aspects of anonymity, that is, on methods of concealing or recovering digital traces on the Internet.

This project has three research goals. The first is to find out whether – as presumed by some experts on data protection – there is in fact a right in Germany to anonymous communication in the Internet and what actually remains of this supposed right in light of the rising flood of security-related legislation. The second is to study the practical significance of "self-data protection," in particular whether users can engage in effective anonymization in spite of contrary legal provisions. The third is to study the effects of legally guaranteed and technologically enforceable anonymity on prosecution and to clarify the question of whether anonymization can actually preclude effective prosecution.

A methodological distinction needs to be drawn between the project’s legal and its technical goals. The former will be investigated by means of an analysis of German legislation, case law, and literature; international instruments that directly or indirectly influence the legal situation in Germany are also included. The technical goals, in contrast, will be pursued via a systematic criminalistic study that addresses the various methods of anonymization as well as their individual advantages and disadvantages.

This project is completed. The results with regard to the first two goals yield a conflicting picture. Many – especially more recent – statutes value and promote anonymity as the strongest form of data protection. At the same time, however, growing tendencies to collect and save data even in the absence of technological necessity – and for longer time periods – are discernable in security legislation. This is especially true of the newly introduced and still highly controversial provisions on the retention of telecommunication data. These kinds of legal provisions create obstacles that can always be evaded by means of technical procedures and transnational cooperation; laws and other legal instruments are, however, making this increasingly difficult.