Clause 202c of German penal code endangers German IT industry

In a substantial report to the Bundesverfassungsgericht (BVerfG, German constitutional court) the Chaos Computer Club (CCC) has studied the impacts of the so-called "Hacker Paragraph", a change to the penal code. The CCC comes to the conclusion, that clause 202c is unsuitable and even runs contrary to the legislator's intended goal.

The programming, making available, distributing or aquisition of so-called hacker-tools, necessary for the daily work of network administrators and security experts, is sanctioned by clause 202c StGB (German penal code). Due to a constitutional complaint against the new clause, the BVerfG is looking into the question, whether it is generally possible to distinguish so-called hacker-tools from allegedly harmless software. The CCC also studied, the likely consequences this new law will have and whether the use of potentially harmful software is necessary for the revision of the security of computer systems.

In the opinion of the CCC, the new fundamental right to the confidentiality and integrity of IT-Systems implies that everybody must be able to test their computer systems for security issues. Therefore the possession, testing, public information sharing and further developing of so-called hacker-tools is mandatory.

[...]

Vorbereiten des Ausspähens und Abfangens von Daten

(1) Wer eine Straftat nach § 202a oder § 202b vorbereitet, indem er

1. Passwörter oder sonstige Sicherungscodes, die den Zugang zu Daten (§ 202a Abs. 2) ermöglichen, oder
2. Computerprogramme, deren Zweck die Begehung einer solchen Tat ist, herstellt, sich oder einem anderen verschafft, verkauft, einem anderen überlässt, verbreitet oder sonst zugänglich macht, wird mit Freiheitsstrafe bis zu zwei Jahren oder mit Geldstrafe bestraft.

(2) § 149 Abs. 2 und 3 gilt entsprechend.