Editing Chaos Computer Club (section)

=== Staatstrojaner affair ===
[[File:Bundestrojaner.jpg|thumb|Mascot used to protest against the Staatstrojaner, a [[trojan horse]]]]
{{see also|FOXACID|MiniPanzer and MegaPanzer|Magic Lantern (spyware)|Heiko Maas#State trojans}}
The Staatstrojaner (''Federal [[Trojan horse (computing)|Trojan horse]]'') is a [[computer surveillance]] program installed secretly on a suspect's computer, which the German police uses to [[wiretap]] [[Internet telephony]]. This "source wiretapping" is the only feasible way to wiretap in this case, since Internet telephony programs will usually [[encryption|encrypt]] the data when it leaves the computer. The [[Federal Constitutional Court of Germany]] has ruled that the police may only use such programs for telephony wiretapping, and for no other purpose, and that this restriction should be enforced through technical and legal means.

On 8 October 2011, the CCC published an analysis of the Staatstrojaner software. The software was found to have the ability to remote control the target computer, to capture [[screenshots]], and to fetch and run arbitrary extra code. The CCC says that having this functionality built in is in direct contradiction to the ruling of the constitutional court.

In addition, there were a number of security problems with the implementation. The software was controllable over the Internet, but the commands were sent completely [[Plaintext|unencrypted]], with no checks for authentication or integrity. This leaves any computer under surveillance using this software vulnerable to attack. The captured screenshots and audio files were encrypted, but so incompetently that the encryption was ineffective. All captured data was sent over a proxy server in the United States, which is problematic since the data is then temporarily outside the German [[jurisdiction]].

The CCC's findings were widely reported in the German press.<ref>{{cite web|url=http://ccc.de/en/updates/2011/staatstrojaner|title=Chaos Computer Club analyzes government malware|date=2011-10-08|access-date=2011-10-10|publisher=Chaos Computer Club}}</ref><ref>{{cite web|url=http://www.spiegel.de/netzwelt/netzpolitik/0,1518,790756,00.html|title=CCC findet Sicherheitslücken in Bundestrojaner|work=[[Der Spiegel]] |access-date=2011-10-10|date=2011-10-09}}</ref><ref name="spiegel">{{cite web|url=http://www.spiegel.de/international/germany/0,1518,790944,00.html|title=Electronic Surveillance Scandal Hits Germany|work=Der Spiegel|access-date=2011-10-31|date=2011-10-10}}</ref> This trojan has also been nicknamed [[R2-D2]]<ref name="cupa">Basil Cupa, [http://www.zora.uzh.ch/81157/1/Cupa_Living_in_Surveillance_Societies_2012.pdf Trojan Horse Resurrected: On the Legality of the Use of Government Spyware (Govware)], LISS 2013, pp. 419–428</ref><ref>[http://www.networkworld.com/news/2011/101911-german-federal-trojan-eavesdrops-on-252153.html German federal Trojan eavesdrops on 15 applications, experts find. The R2-D2 surveillance Trojan also has support for 64-bit Windows systems] {{webarchive |url=https://web.archive.org/web/20140201224023/http://www.networkworld.com/news/2011/101911-german-federal-trojan-eavesdrops-on-252153.html |date=2014-02-01}}</ref> because the string "C3PO-r2d2-POE" was found in its code;<ref name="naked"/> another alias for it is 0zapftis ("It's tapped!" in [[Bavarian language|Bavarian]], a sardonic reference to [[Oktoberfest#Beer barrel tapping|Oktoberfest]]).<ref name="naked">{{cite web|url=https://nakedsecurity.sophos.com/2011/10/10/german-government-r2d2-trojan-faq/|title=German 'Government' R2D2 Trojan FAQ|date=2011-10-10|access-date=2018-12-28}}</ref> According to a [[Sophos]] analysis, the trojan's behavior matches that described in a confidential memo between the German [[Landeskriminalamt]] and a software firm called ''{{ill|DigiTask|de}}''; the memo was leaked on [[WikiLeaks]] in 2008.<ref name="naked"/> Among other correlations is the dropper's file name {{mono|scuinst.exe}}, short for Skype Capture Unit Installer.<ref>{{cite web|last=Leyden|first=John|title=German states defend use of 'Federal Trojan'|url=https://www.theregister.co.uk/2011/10/12/bundestrojaner/|website=The Register}}</ref> The 64-bit Windows version installs a digitally signed driver, but signed by the non-existing [[certificate authority]] "Goose Cert".<ref>{{cite web|url=https://www.helpnetsecurity.com/2011/10/19/federal-trojan-has-more-capabilities-than-previously-thought/|title=Federal Trojan has more capabilities than previously thought|first1=Zeljka|last1=Zorz|date=2011-10-19|website=Help Net Security|access-date=2018-12-28}}</ref><ref>{{Cite web |url=https://securelist.com/federal-trojans-got-a-big-brother/31349/ |title=Federal Trojan's got a "Big Brother" |date=2011-10-18 |work=Securelist |first=Tillman |last=Werner |access-date=2021-03-16}}</ref> DigiTask later admitted selling spy software to governments.<ref>{{cite web|url=https://www.dw.com/en/german-company-behind-government-spyware-admits-sale-to-bavaria/a-15453150|title=German company behind government spyware admits sale to Bavaria – DW – 11.10.2011|website=DW.COM|access-date=2018-12-28}}</ref>

The [[Federal Ministry of the Interior (Germany)|Federal Ministry of the Interior]] released a statement in which they denied that R2-D2 has been used by the [[Federal Criminal Police Office (Germany)|Federal Criminal Police Office]] (BKA); this statement however does not eliminate the possibility that it has been used by state-level German police forces. The BKA had previously announced however (in 2007) that they had somewhat similar trojan software that can inspect a computer's hard drive.<ref name="spiegel"/>