Despite being one of Austria's most powerful institutions, the Federal Agency for State Protection and Counterterrorism (abbreviated BVT in German) does not enjoy a good reputation. Numerous past incidents have branded the BVT and damaged its international standing. Among foreign intelligence services, Austria is considered a "security gap." An audit report by the "Club de Berne", which includes directors of all domestic intelligence services of the EU member states, Norway and Switzerland, identifies severe deficiencies. A parliamentary investigation committee on the BVT house search during the Kickl era as well as the tragic attack in Vienna on 2 November 2020 finally prompted a comprehensive reform. The scandal-ridden BVT is to be restructured and professionalized. For that purpose, the Federal Ministry of the Interior created the project “BVT neu” (= new BVT). It is aimed at reorganizing intelligence service and state protection in accordance with international standards. We already addressed the issue last year with our 12 benchmarks for the BVT reform.

In order to make sure that the government does not foist further invasive surveillance measures on us or curtails our fundamental rights, we have closely examined the current draft reform. In our legal statement, we point out problems and offer suggestions for solutions.

Separation of state protection and intelligence tasks at organizational level

According to the draft reform, state protection and intelligence service will be separated. The key task of state protection is to provide preventive protection against attacks which pose a threat to the constitution, if there is reasonable suspicion that a person may commit an attack of such kind. The intelligence service is tasked with extensive, in-depth research of possible threats. This includes the observation of groups if severe danger to public safety due to associated crime is to be expected, especially due to violent acts committed out of an ideological or religious motivation. According to the draft reform, intelligence tasks will fall within exclusive competence of the Directorate for State Protection and Intelligence (abbreviated DSN in German). The agencies at provincial level, which previously carried out intelligence tasks as well, will from now on only be tasked with police state protection matters. The DSN shall have one director and two deputies – one each for intelligence and state protection matters respectively. To ensure a flow of information between these two legally separate units, an organizational unit will be set up.

This is the government’s idea of a “clear separation”, which in our view the draft does not provide for. State protection and intelligence service will remain united under one authority. Both will be under the control of one single director. However, this is precisely the main point of criticism expressed by international intelligence services regarding the Austrian model of state protection. If the government is really serious about separation at organizational level, it must separate intelligence service and police state protection completely.

We see a further problem in the fact that the DSN is to remain part of the Directorate General for the Public Security in the Ministry of the Interior. This means that the director of the DSN is subordinate to the Director General for the Public Security, who in turn is subordinate to the Minister of Interior. As you might have guessed already, this will neither strengthen nor depoliticize the area of state protection. Much rather, it further secures the current influence the Minister of the Interior can exert on the authority.

Attack which poses a threat to the constitution

What is an attack which poses a threat to the constitution anyway? Such an attack consists in the commitment of certain crimes, such as the formation of a terrorist organization (§ 278b Austrian Criminal Code) or terrorist financing (§ 278d Austrian Criminal Code). According to the draft (§6Abs3Z2), however, certain crimes, if committed out of "ideological or religious" motivation, may also constitute such an attack. The ambiguity of the draft does not even allow for a precise understanding as to what is meant by such a motivation. As a result, the provision gives the impression that a simple physical injury inflicted out of ideological or religious motivation constitutes an attack that threatens the constitution whereas a physical injury inflicted without such a motivation does not.

This rings alarm bells for us, as this interpretation results in unequal treatment which would be unconstitutional due to violation of the principle of equality. Moreover, the draft does not explain why the crimes in question are considered more dangerous than others if committed out of ideological or religious motivation and why special investigation powers are even needed. It is imperative that this provision be removed without replacement!

Search powers

According to the draft, the director may search individuals entering, leaving, or staying in the DSN building or on DSN premises as necessary to protect classified information. This includes opening and searching containers and items the person is carrying. Now, the thing is that any search of persons and their belongings falls within the scope of Article 8 ECHR. A search is permissible only if it is provided for by law, adequate and proportionate. However, an unprovoked and arbitrary search of such kind is not even remotely proportionate and we firmly disapprove of it. Instead, we demand that such a search may only take place if the suspicion that a person poses an actual threat to the protection of classified information is substantiated by certain facts. This is a very central point, which is necessary to ensure that people are not subject to arbitrary encroachments on their fundamental rights. It must be spelled out clearly in the draft provision.

Furthermore, the draft stipulates that the director is authorized to provide intelligence officers with a service weapon. Brief reminder: state protection and intelligence service are to be separated from one another. This is what the government strives for, at least according to its own assertions. It has already assured and emphasized several times that intelligence officers will not hold executive power, since police state protection and analytical research of threats (intelligence) will be strictly separated. If so, why exactly is there a provision that allows intelligence officers to carry weapons? Intelligence officers are not even authorized to undertake acts of law enforcement. As soon as there is a concrete suspicion it is the police’s turn and the intelligence service is no longer competent in the matter. We therefore demand that § 2b para 2 of the draft be removed entirely. Somebody who is not even remotely authorized to use a weapon, should not carry one on the job in Austria.

State protection case conference & introduction of a joint counterterrorism center

A case conference is to be introduced. Its aim is to cooperatively develop and coordinate suitable deradicalization and integration programs in order to prevent attacks. In principle, we support this proposal. However: the convocation of a case conference shall be possible if an individual is going to commit an attack that poses a threat to the constitution. The suspicion of such a threat is reasonable if the attack is going to take place in the foreseeable future. Therefore, it’s not enough to say that “it cannot be ruled out that this individual will commit such an attack." Unfortunately, the draft text does not expressly require that the suspicion be reasonable. This means that it is possible to convoke a case conference even if there is no reasonable suspicion of a threat yet. In our opinion, it is imperative to include a reasonability requirement, so we appeal to the government to speak of a reasonable suspicion in the draft.

According to the draft, a joint counterterrorism center including agencies at both federal and provincial level shall be introduced as well. The platform is supposed to serve as a regular meeting point for the most important intelligence services to exchange information with the purpose of preventing attacks that pose a threat to the constitution. In Austria it is essential that this platform will not be limited to Islamism. It can help to identify dangers at an early stage and counter them with appropriate preventive measures. The benefit here is that the joint counterterrorism center can take action without having to ex-ante review every individual case as to whether the requirements for a case conference are given. This could buy time and minimize the risk of taking imprudent and hasty measures due to pressure of time.

The thing about IMSI catchers

It is already possible to locate a telephone via request to mobile operators for in-depth threat research and preventive protection against attacks that pose a threat to the constitution if the investigation task cannot be carried out successfully using other investigative measures. However, so far the BVT has been denied this surveillance power. In the run-up to the BVT reform, Minister of the Interior, Karl Nehammer, repeatedly assured that surveillance powers will not be expanded. And now we have a draft laying in front of us, which contains precisely that: an expansion of surveillance powers.

The evaluation report of the terrorist attack on 2 November has made it clear that state protection authorities possess sufficient means and possibilities to accomplish their task. It was due to failure of authorities and not a lack of their powers that lives were lost on 2 November. A security agency which is currently at a low regarding its public trust should not be given even more power.

Another expansion of powers: Until now, it was only possible to request certain booking-related personal data (e.g. booking date of a trip, itinerary, fellow travelers) from passenger transport companies. Now the government wants to extend such requests for information to operators of online reservation and global distribution systems. This provision is specifically targeted at obtaining data from websites such as Skyscanner, Kayak or Expedia.

Legal Protection Officer

Before state protection authorities carry out a task, they must obtain authorization from the legal protection officer. This also applies to special investigative measures or further processing of data collected. The legal protection officer’s task is to protect the rights of people subjected to such measures, especially in case of undercover investigation. This is because in such cases subjects are rarely notified of measures and if so, it is only afterwards. Unfortunately, practice has taught us that the role of legal protection officers is much more enabling than supervisory.

Under the amendment, the legal protection officer will for the first time be obliged to justify their authorizations. While this is of course a sensible step, it also highlights the lack of control that has persisted in the BVT up to now. To put it plainly: to date, the one authorization body for undercover surveillance measures did not even have to justify its decisions. We propose to include a balancing of interests in this justification. The legal protection officer must weigh the public interest against the rights of the person subjected to surveillance measures and justify their decision with regard to these two legal interests. We hope this helps to ensure that legal protection officers cease to wave everything through and start to take a closer look at investigative measures. After all, the burden of justification for any encroachment on fundamental rights lies with the state and not with the individual whose rights are being encroached upon.

Other government plans for the legal protection officer include extending the term of office from five to ten years and excludes re-election. This is a mere fig leaf and by no means sufficient to resolve the grave deficit of independence. The legal protection officer is part of the Ministry of the Interior. This makes them nothing more than an “in-house” supervisory authority, who will authorize almost anything. They hardly ever reject a surveillance measure, but rather provide advice on how a certain measure could still be authorized. This authorization procedure does not even come close to meeting requirements for an independent review in accordance with the rule of law.

In order to finally solve this problem, the supervisory body must be restructured – especially taking into consideration the intended separation of police and intelligence service: it is neither comprehensible nor conducive if the Ministry of the Interior can legally authorize the measures it has taken itself. This is why we demand independent judicial review, or for the supervisory body to be transferred out of the Ministry of the Interior.

Parliamentary oversight

According to the draft, the Directorate is obliged to deliver an annual report to the Minister of the Interior. The Minister must then submit this report to the Standing Subcommittee. Apart from general information on the activities of the Directorate and its organizational units, the report will contain in-depth insight on groups under observation. The Directorate report is complemented with a slight expansion of the Minister of the Interior's reporting duties to the Standing Subcommittee. This is all well and good, but let’s be honest: it is nothing more than self-evident. If you’re serious about effective parliamentary oversight, you can’t settle for the self-evident.

Sensible parliamentary control also ensures that the delicate area of state protection is firmly rooted in our democratic system. This is why the scope of tasks of the intelligence service must be approved with a two-thirds majority, as well as any cooperation with foreign services. If classified information contains indications of criminal offenses, the committee must have the opportunity to declassify this information and report it. There should be a minority right to question intelligence officers under the obligation to tell the truth and to take administrative and legal measures against them if they broke the law or violated their scope of tasks.

Independent Control Commission

To ensure that tasks are completed in accordance with the law, an independent control commission will be instated with the Minister of the Interior. While we support the introduction of a control commission in principle, there is still a lot of room for improvement.

1. The control body, as currently designed in the draft, is nothing more than a toothless paper tiger: Although it can identify and address a “need for optimization”, it can take neither administrative nor disciplinary measures or impose budgetary sanctions in case of misconduct. If you look at other countries, you can see how essential effective control with actual consequences is. As it is currently designed, this body will fail to fulfill this central task. 
2. The control commission will serve as a contact point for whistleblowers. Yet, the draft completely lacks protective provisions. It only mentions the technical infrastructure, which is supposed to enable whistleblowers to submit information both anonymously or under their name. That’s it. Whistleblowers risk a lot to inform the public and to bring misconduct or deficiencies to light. They must be supported in their courageous actions and they must be offered airtight protection. They must be protected from criminal prosecution and be granted the right to anonymity and confidentiality.
3. According to the draft judges, prosecutors and lawyers cannot be appointed as members of the control body. We are puzzled as to why members of the judiciary are categorially excluded.
4. The control commission must be granted access to all relevant documents and records by state protection authorities. This means that the flow of information from state protection authorities to the control commission is not limited by official secrecy. However, since the Austrian government is not known for its commitment to transparency, it also included an exception here which we reject as it is excessive. The exception provides that this right to access does not apply to information and documents about individuals or sources, if their disclosure would pose a threat to national security or the security of individuals, or if the interests of foreign security agencies prevail. This control body will be instated to ensure that state protection authorities properly fulfill their tasks in accordance with the law. It is obvious that it needs unlimited access to all documents in order to do so. If this unlimited right to access does not find its way into the law, we have another Turquoise-Green scam.
5. Apart from documents and records, the control commission should also be able to monitor the intelligence service’s data processing. This international best-practice is used to detect misconduct based on suspicious patterns of increased deletion or log-ins/accessing.
6. Obligatory report: the commission must deliver an annual report to the Minister of the Interior and the Standing Subcommittee, in which it has to address the fulfillment of its tasks and can also make recommendations. The report should also contain findings and suggestions for improvement regarding the Directorate for State Protection and Intelligence (DSN). This report should be made public and the control commission should also be obliged to inform whether its recommendations are being implemented.

We deeply regret that the government failed to actually separate intelligence service and state protection. As long as this separation does not become a reality, Austria will not be able to regain the trust of foreign services in the international arena.

Instead, this draft is a carte blanche for attacks that pose a threat to the constitution. As designed in the draft, the “control” body cannot control anything – neither to review the intelligence service’s action regarding legality, nor to improve security precautions or the quality of the service’s work.

The draft is in urgent need of significant improvement. Otherwise we won’t get a trustworthy authority, but rather receive yet another basket of fool’s gold the government can boast about.

See our entire legal statement (only in German) here