In Berlin, police are now legally permitted to secretly enter private homes to install state Trojans or other spyware on IT systems if remote installation is not technically feasible [1] [2] [3]. This significant amendment to the General Security and Public Order Act (ASOG) was passed by the Berlin House of Representatives with the majority votes of the CDU and SPD coalition, along with the opposition AfD [1] [3].

According to www.iAsk.Ai - Ask AI:

This new legislation, particularly paragraphs 26a and 26b, allows for "source telecommunications surveillance" (Quellen-TKÜ) and secret online searches [1] [3]. The primary purpose is to intercept encrypted communication on devices like smartphones and laptops [1] [3]. While the law prioritizes remote installation of malware, paragraph 26 explicitly grants investigators the power to "secretly enter and search premises" to gain physical access to IT systems, for instance, to install a Trojan via a USB stick [1] [2] [3]. This move mirrors a similar legal change previously enacted in Mecklenburg-Western Pomerania [1] [2] [3].

Beyond the installation of state Trojans, the amended Police Act introduces several other expanded police powers:

• Bodycams in Private Spaces: Paragraph 24c allows police to activate bodycams in private homes and other non-public areas if there are concrete indications of a threat to life or limb [1].
• Expanded Cell Tower Queries: Paragraph 26e broadens the scope of cell tower queries, enabling police to request traffic data from all mobile phones within a defined cell tower area at a specific time. Critics argue this could lead to the creation of movement profiles for thousands of innocent citizens [1].
• Automatic License Plate Recognition: Paragraph 24d establishes the legal basis for automatic license plate recognition systems, which scan license plates in traffic and compare them with wanted databases [1].
• Counter-Drone Measures: Paragraph 24h permits the use of technical means against unmanned systems like drones, including taking over their control [1].
• Facial and Voice Recognition: Paragraph 28a allows police to perform biometric comparisons of faces and voices with publicly accessible data from the internet, facilitating automated searches on social networks or photo platforms using surveillance footage [1].
• AI Training with Personal Data: The new paragraph 42d permits the processing of personal data for "training and testing of artificial intelligence systems," raising concerns among data protectionists about the re-purposing of sensitive data [1].
• Extended Preventive Detention: The maximum duration of preventive detention has been extended from 48 hours to up to five days, and even seven days in cases of imminent terrorist offenses, under the revised paragraph 33 [1].

These changes have drawn significant criticism from various groups. Opposition parties, such as Die Linke and the Greens, have labeled it a "black day for civil liberties" and constitutionally risky [1]. IT security experts warn about the creation of vulnerabilities and see a constitutional violation in the combination of residential space intrusion and digital investigation [1] [2] [3]. Data protection officers, like Berlin's Meike Kamp, view the legalization of state Trojans as a "frontal attack on the IT security of all citizens" [1]. The Society for Civil Rights (GFF) has previously lodged a constitutional complaint against the mass use of state Trojans in Germany, arguing that such measures violate the fundamental right to the confidentiality and integrity of information technology systems and create perverse incentives for authorities to exploit security gaps rather than report them [4]. The GFF has also indicated it will examine a constitutional complaint against Berlin's new law [1].