Die Haecksen sind eine Gruppe im Umfeld der deutschen Hacker*innenszene. Sie richtet sich an Techniker*innen, Hacker*innen, Maker*innen, Wissenschaftler*innen, Künstler*innen, Aktivist*innen und solche, die es werden wollen. Die Gruppe versteht sich als queer-inklusiv und setzt sich für Queerfeminismus ein – auch in MINT-Berufen und der Hacker*innenszene.
Wir haben mit zwei Haecksen gesprochen: melzai und micma. melzai ist promovierte Informatikerin mit dem Schwerpunkt auf IT-Systeme im pharmazeutischen Kontext. Sie ist seit über 10 Jahren bei den Haecksen und im Chaos aktiv und derzeit die Vorstandsvorsitzende des Haecksen e.V.
micma ist zufällig in das Kick-Off der Chaos Feminist Convention Orga geraten. Seitdem ist sie Teil der Haecksen und hat im Content- und Konzept-Team die erste Chaos Feminist Convention „Utopia Test Environment“ mitgestaltet. Beruflich: liebt sie Wissensvervielfältigung. Privat: verschlingt sie abwechselnd Bücher, vegane Süßigkeiten und News zu Kultur und Technik.
Eine große dezentrale Community
netzpolitik.org: Was war der Anlass für dieses neue Chaos-Event, das sich im Umfeld des Chaos Computer Clubs verortet?
melzai: Wir Haecksen hatten alles gemacht, was parallel zum Congress des CCC möglich ist. Die Haecksen hatten schon seit den 1990er-Jahren einen Raum auf dem Congress und seit einigen Jahren haben wir den wieder benutzt. Nach der Pandemie waren Workshops dort völlig überlaufen, die Haecksen sind zuletzt jedes Jahr um 100 Personen gewachsen und so habe ich beim letzten Camp gefragt, ob wir mal was eigenes machen. So können wir selbst die Inhalte kuratieren und gleichzeitig lernen, solche Events zu tragen und diese Verantwortung auch in der Gruppe zu übernehmen. Es ist einfach etwas anderes, wenn wir selbst die volle Verantwortung für alles von der Werkzeugbeschaffung über Verträge bis zum Budget tragen.
netzpolitik.org: Aber ihr werdet auch weiter bei Chaos-Events präsent sein?
melzai: Wir trennen uns nicht, nein. Es ist kein Entweder-oder, sondern eher ein Jetzt-endlich.
netzpolitik.org: Welches Ziel habt ihr über diese tendenziell organisatorischen Fragen hinaus mit der Veranstaltung verfolgt?
micma: Die Haecksen sind eine sehr große dezentrale Community, die sich auf verschiedenen Events trifft, etwa bei lokale Haecksen-Frühstücken. Es kennen sich nicht alle untereinander und eine eigene Convention ist ein Raum für Begegnung, über Online-Räume oder lokale Treffen hinaus.
melzai: Bei unseren Workshops auf Chaos-Events müssen wir hoffen, dass die Themen, die wir relevant finden, auch von Leuten vorgetragen werden, die das inhaltlich gut machen.
Mit dem eigenen Event können wir Leute einladen und auf Notwendigkeiten wie Honorare oder Fahrtkostenerstattung eingehen. Und das konnten wir auf den Chaos-Events nicht. Für aktivistische Arbeit wie Antirassismus oder Queerfeminismus, die vielleicht auch schwierig zu verstehen sind, wollten wir Geld in der Hand haben, um Beiträge von qualifizierten Personen einladen zu können.
Rückblick auf die erste „Chaos Feminist Convention“
netzpolitik.org: Wie ist das gelaufen aus eurer Sicht?
micma: Ja, also die erste Chaos Feminist Convention hat stattgefunden, die Tickets waren schnell weg, ich habe viele glückliche Gesichter gesehen, auch viele aufgeregte Gesichter vor Workshops oder Talks. Es gab manche, die schon Expert*innen sind, und manche, die das noch gar nicht so oft gemacht haben. Es war unsere erste und sie hat stattgefunden!
netzpolitik.org: Worüber habt ihr euch gefreut, was ist gut gelaufen?
Inzwischen gibt es die Haecksen schon über 35 Jahre. – CC-BY-ND 4.0 Anne Roth
melzai: Die Stimmung war super, die Beiträge waren sehr mannigfaltig und auch das remote Angebot wurde sehr aktiv genutzt, weil wir in der Haecksen-Community auch Menschen haben, die nicht vor Ort dabei sein können. Deswegen gab es ein hybrides und remote Angebot und zum größten Teil hat es auch funktioniert.
netzpolitik.org: Wie viele Leute haben remote teilgenommen, waren also nicht vor Ort?
melzai: Etwa 130. Außerdem sind auch englischsprachige Besuchende in Hamburg vor Ort teilweise dorthin gewechselt, wenn es vor Ort nur deutschsprachige Angebote gab, remote aber etwas auf Englisch.
netzpolitik.org: Gab es Sachen, die nicht so gut geklappt haben?
melzai: Ich glaube, unsere Besuchenden wollten gern mehr helfen und das ging nicht, weil wir vorher alles schon so durchgeplant haben. Es ist ja auch ein Teil vom Geist des Events, dass man quasi helfend dort sitzt und dabei andere Leute kennenlernt. Und Rückzugsorte – ich denke, mehr Raum für so viele Leute wäre sicherlich auch nett gewesen.
Zurück zu den Wurzeln
netzpolitik.org: Was war der Grund dafür, dass ihr als Ort das Kulturhaus Eidelstedt ausgesucht habt?
melzai: Also, es ist zum einen natürlich geschichtsträchtig – es war, damals noch als „Bürgerhaus Eidelstedt“, der Gründungsort vom Chaos Communication Congress! Die Person, die das Haus leitet, ist mit dem Chaos eng befreundet. Außerdem bekommen wir dort als gemeinnütziger Verein Sonderkonditionen.
Wir haben wir in Hamburg außerdem eine große lokale Gruppe und einige Leute müssen doch mal vor Ort sein. Niemand sagt, dass die Convention so klein bleiben muss. Das ist ja die Entscheidung der Gemeinschaft, wie groß die Convention langfristig wird.
netzpolitik.org: Es gibt wegen der Brandschutzbestimmungen eine Begrenzung auf 200 Personen im Gebäude. Habt Ihr das in Kauf genommen, weil es dort nicht anders geht, oder war euch diese Begrenzung gerade recht?
melzai: Ich glaube, da sind zwei Sachen zusammengekommen. Wir hatten über 400 und 600 Personen in einer anderen Location nachgedacht, aber das wäre finanziell schwieriger gewesen. 200 war eine gute Größe, denn das hieß, dass wir alle Orga-Teams aufbauen mussten, aber gleichzeitig sind 200 Personen eine überschaubare Menge. Wenn irgendetwas fehlt, kann es im Supermarkt nachgekauft werden. Wahrscheinlich dachte der Chaos Computer Club vor fast 40 Jahren auch schon, dass es ein guter Ort ist, um etwas anzufangen!
netzpolitik.org: Das heißt auf der anderen Seite auch, dass eine ganze Menge Leute nicht kommen konnten, die vielleicht gerne gekommen wären. Gab es da spürbare Unzufriedenheit?
melzai: Nein. Es ist eher so, dass die Rückmeldungen extrem positiv waren, seit wir den Gedanken ausgesprochen hatten, dass wir so etwas vorhaben. Bei den Tickets hatten wir welche für die Sprechenden und für die Helfenden reserviert. Im freien Verkauf waren dann die Tickets innerhalb von 20 Sekunden weg. Als danach noch einige rausgingen, ging dann auch der Server in die Knie.
Aber das führte auf Mastodon, wo wir aktiv sind, nicht zu negativer Stimmung. Ich glaube, die ganze Gemeinschaft will, dass das stattfindet. Und hofft, dass es dann Stück für Stück größer wird.
Haecksen und Chaos
netzpolitik.org: Ist es aus eurer Sicht eher ein Chaos-Event oder eher ein feministisches/FLINTA-Event?
micma: Ich denke, es vor allem ein Haecksen-Event und es ist auch ein queerfeministisches Event. Haecksen gibt es fast so lange, wie es das Chaos gibt. Aber gleichzeitig ist es eine eigene Veranstaltung und wird von anderen Personen getragen. Es gibt auch viele Überschneidungen, aber ich sehe die Chaos Feminist Convention schon als etwas Eigenes.
melzai: Ich denke, sie nimmt Elemente aus dem Chaos auf, die wir gut finden. Das sind dieser sehr kreative Umgang mit Technik, die Möglichkeit als Person mit einem guten Thema die Bühne zu bekommen, die Möglichkeit, dass sich der Eventpreis möglichst an den Selbstkosten orientiert, die Verfügbarkeit der Aufzeichnungen hinterher. Dazu gehört auch das Thema Accessibility, sodass es zum Beispiel einige dafür reservierte Sitzplätze gibt. Und dass wir ein Awareness-Team haben, das auf die Besuchenden achtet. All diese Elemente findet man auch im Chaos.
Aber in sich ist es ein Haecksen-Event und das war halt anders, weil der Hintergrund der Leute ein anderer ist. Deswegen gab es zum Beispiel keine Chaos-Post. Die hätte es natürlich geben können, aber sie ist einfach nicht spontan entstanden.
Ein Raum für queerfeministische Werte
netzpolitik.org: Was hat sie zu einem queerfeministischen Event gemacht?
micma: Also einerseits der Verein selber. Die Haecksen verstehen sich als FLINTA und für die erste Chaos Feminist Convention hatten wir queerfeministische Utopien als Motto. Wir wollten einen Raum eröffnen, um darüber nachzudenken, was eine queerfeministische Utopie eigentlich bräuchte. Es ging darum, sich mit Personen dafür Zeit zu nehmen, die aus ganz unterschiedlichen Bereichen kommen und verschiedene Backgrounds haben. Queerfeministische Werte können auch für jede Person etwas komplett Unterschiedliches bedeuten.
melzai: Wir hatten fünf Tracks, zum Beispiel: „Science & Fiction – Wie könnte eine queerfeministische Utopie aussehen?“, „Tech & Engineering – Test Environment – Was wären technische Konzepte für die Zukunft?“, „Change & Feelings – Un_Sicherheit, Angst, Wut, Wellness und Empowerment“. Das gibt eine Richtung vor, die ich im Chaos ein bisschen im Hintergrund sehe.
Bei uns sind diese Komponenten extrem wichtig und stehen deutlich im Vordergrund. Das sind Sachen, die wir gerne durchdiskutieren würden. Was uns in den letzten Jahren gefehlt hat, war eine aktive Diskussion über Utopien, wo wir eigentlich hin wollen und wie es sich anfühlen könnte, wenn wir dort angekommen sind.
Wir verlieren uns im Klein-klein und in den Problemen der Welt, statt dass wir mal auf die positive Möglichkeit der Zukunft schauen. Aber vielleicht finden wir so einen Baustein, den wir in Angriff nehmen können.
Die Suche nach Utopien
netzpolitik.org: Wie wurde die Suche nach Utopien umgesetzt?
micma: Dass eine Gruppe, die sich teilweise nur per Nickname im Chat kennt, eine Convention für eine Community mit unterschiedlichen Bedürfnissen geschaffen hat, ist für mich schon etwas Bedeutsames. Es war ein erster Versuch und auch Kennenlernen in dieser Konstellation. Und das Motto war ja auch „Utopia Test Environment“. Für mich war auch die Chaos Feminist Convention selber wie eine großes Utopia-Testumgebung. Alle hatten Vorstellungen, aber niemand hätte sicher sagen können, wie das aussieht. Jetzt haben wir einen ersten Eindruck und die zweite kann auch wieder ganz anders sein.
melzai: Das erinnert mich so ein bisschen an unsere feministische Bibliothek, die wir bei jedem Event neu aufstellen, da tauchen immer andere Bücher auf. (Beide lachen)
2025-07-14 1159.12 97
– für digitale Freiheitsrechte!
Euro für digitale Freiheitsrechte!
Dadurch ist sie ja immer aktuell, weil die Leute die Bücher mitbringen, die sie für relevant halten. Spannend fand ich an der Convention, dass das Löten neben dem Workshop für hormonelle Selbstermächtigung steht, neben dem Workshop für Menstruations-Apps und neben dem Workshop für Gips-Abdrücke der Oberkörper. Es gab Techie-orientierte Vorträge, Soziologie-orientierte Vorträge und auch einen über Ernährung und ich glaube, da kann man vielleicht auch die queerfeministische Vision sehen.
Bei einem Beitrag ging es vor allem um Handarbeit, was wirklich ein wichtiges Thema für die Haecksen-Community ist. Es gibt eine Haeckse, die hat einen Fuhrpark für mehrere tausend Euro und veranstaltet Workshops schon seit Jahren dazu. Crafting neben Löten neben den anderen Thematiken, das passt alles zusammen.
Ein buntes Potpourri – mit Fokus auf Technik
netzpolitik.org: Ist das mit dem Programm gelungen, so wie es dann war? Oder gab es ein buntes Potpourri?
micma: Also es gab schon das bunte Potpourri. Es ist uns gelungen, Impulse zu setzen und gleichzeitig war uns wichtig, dass alle ihre Themen mitbringen können. Und das gibt ja wiederum Impulse, um vielleicht queerfeministische Utopien zu finden. Was kann zum Beispiel Fiction oder was hat kreatives Schreiben mit uns und unseren Utopien zu tun?
Aber es gab es natürlich auch Vorträge, die FLINTA-Personen als Betroffene von patriarchalen Strukturen wahrgenommen haben. Wir haben als Community, aber vor allem als FLINTA-Personen verschiedene Erfahrungen der Diskriminierung gemacht, auch intersektional gedacht, und was bräuchten wir, um queerfeministische Utopien sicher und angenehm für eine breite Masse an Individuen zu machen.
netzpolitik.org: Wer waren die Teilnehmer*innen?
melzai: Beim Alter reichte es von ungefähr 16 bis ungefähr 70. Bei der Gender-Diversität lag der Schwerpunkt stark auf dem FLINTA-Bereich, aber nicht nur. Es gab auch Cis-Männer, die sich in diverse Workshops gewagt haben, was ich sehr gut fand. Das war eigentlich die Idee. Wir hatten nicht nur Deutsch sprechende Beitragende und Besuchende, sondern auch Leute aus verschiedenen, nicht nur europäischen Ländern. Wir waren also jetzt schon international.
netzpolitik.org: Beim Congress gab es über Jahre immer wieder von einigen die Kritik, dass das Programm immer politischer sei und immer weniger Wert auf technische Themen gelegt würde. Wie wichtig ist euch Technik?
melzai: Mir ist Technik sehr wichtig. Deswegen denke ich, so eine gute Mischung ist der Trick.
micma: Ich sehe eine sehr starke IT- und Technik-Affinität bei sehr vielen Haecksen. Und gleichzeitig haben wir ganz unterschiedliche Interessen. Ich habe zum Beispiel noch nicht gestrickt. Es gibt aber Personen, die mir gezeigt haben, wie viel Technik dahinter steht, auch bei der Digitalisierung von Textilproduktion. Da gab es auch Lochkarten wie bei den ersten PCs. Und das haben mir Haecksen erklärt, die nicht beruflich in der IT arbeiten.
melzai: Dein Beispiel mit dem Stricken war super. Es gibt auch die programmierbaren Stick-Maschinen, mit denen man Einführungs-Workshops in Programmierung machen kann. Da können alle ein T-Shirt als Endprodukt mit nach Hause nehmen. Wir Haecksen sehen Technik auf vielen unterschiedlichen Niveaus, von Einführungen in verschiedene Bereiche bis hin zu Expert*innen-Workshops. Und das läuft bei uns alles unter Technik. Stricken nach Muster ist ja auch eine Form von Programmierung. Mir kann mir niemand erzählen, dass die Person nicht programmieren könnte, die so ein Strickmuster runterarbeitet.
Mitträumen, mitgestalten und mitdiskutieren
netzpolitik.org: Wobei gerade Stricken und Sticken natürlich wahnsinnig geschlechterstereotyp sind.
melzai: Unser Sauerteigbrot möglicherweise auch – wir hatten einen sehr aktiven Channel mit Backrezepten, schon vor der Pandemie. Aber in Wirklichkeit ist das eine komplizierte Kulturtechnik, nicht wahr?
netzpolitik.org: Keine Frage, ich stricke seit vielen Jahren, ich bin da total dabei, aber wie sahen technische Content-Teile aus, die sich auf anderes bezogen?
micma: Es gibt die Security-Haecksen, die sich mit IT-Sicherheit beschäftigen, teilweise auch beruflich. Dazu gab es Treffen und einen eigenen Track. Bei einigen Workshops ging es darum, Technik queer- oder FLINTA-friendly zu gestalten. Beim Thema Barrierefreiheit ging es darum, wie Software oder Hardware auf bestimmte Bedürfnisse zugeschnitten werden. Es gab eine Person, die eigene Keyboards designt hat. Da kann es um Barrierefreiheit gehen oder einfach darum, was du schön findest. Vielen Personen ist nicht bewusst, dass es eine furchtbare Erfahrung sein kann, mit einem speziellen Reader eine Webseite aufzurufen, wenn die nicht spezifisch nach Kriterien der Barrierefreiheit ausgerichtet ist. Das ist auch 2025 noch sehr relevant.
netzpolitik.org: Wie geht es weiter? Gibt es die Convention nächstes Jahr wieder?
melzai: Das können wir noch nicht beantworten. Übernächstes Jahr ist das Camp, deswegen bietet sich ein Zwei-Jahres-Rhythmus nicht an, aber wir sind auch nicht sicher, ob wir dann schon nächstes Jahr noch eine Convention machen. Aber was wir sicher wissen, es wird eine nächste geben.
micma: Ich würde gerne einfach mehr Menschen diese Freude mitgeben, die ich mitgenommen habe. Traut euch, Räume zu schaffen, in denen alle mitträumen, mitgestalten und vielleicht auch mitdiskutieren können, wenn sie es wollen.
Hinweis: Anne Roth, die das Interview für netzpolitik.org führte, hat bei der Veranstaltung einen Vortrag gehalten und einen Workshop gegeben. Sie ist außerdem an der Haecksen-Arbeitsgruppe zum Thema digitales Stalking beteiligt.
This is a joint investigation with Bayerischer Rundfunk, L’Echo (Belgium), Le Monde (France), BNR (Netherlands). It is part of the “Databroker Files”. A German version of this article was published under the title „Datenhändler verkaufen metergenaue Standortdaten von EU-Personal“.
There are detached houses with front gardens in an upmarket district of Brussels, and the political centre of the European Union is not far away. When they are out and about early in the morning, a top EU official only needs about 20 minutes by car to get to their workplace. They work in a unit under the authority of Commission President Ursula von der Leyen at the Berlaymont building, the European Commission’s headquarters. Conveniently, there’s a spa and fitness centre along their way to work – they have passed by it, too.
We know this and more because we have their exact location data. The data even tells us exactly where their office is in the EU Commission building. We discovered their movement patterns, along with those of millions of other Europeans, in commercially traded data.
This data reveals where people live and work, as well as their behaviour and preferences. It can also show visits to clinics, religious buildings, party and trade union headquarters, as well as brothels and swingers‘ clubs.
The investigative team has data records from several data brokers. They are giving these away as a sample — a free preview of what is on offer with a paid subscription. For this investigation, we analysed two new datasets containing around 278 million records of mobile phone locations in Belgium.
Danger of espionage like during the Cold War
Almost ten years ago, a revolution with four letters took place here in Brussels: GDPR. In December 2015, the European Parliament, the Council and the European Commission agreed on the text of the General Data Protection Regulation. It was intended to harmonise the protection of fundamental rights in the digital world with a data-based economy. And it came with the promise of informational self-determination: that people should generally have sovereignty over who does what with their data.
This promise remains unfulfilled to this day. Instead, the Databroker Files reveal an unprecedented loss of privacy that can affect all people who participate in digital life by using apps on smartphones or tablets. The uncontrolled data business is no longer just an issue of consumer and fundamental rights protection; it also poses a threat to Europe’s security.
The risk of espionage in the EU is high, at least since Russia launched its large-scale war of aggression against Ukraine in February 2022. Authorities warn of Russian sabotagesuspicious drones violate European airspace, a Chinese spy infiltrated the EU Parliament – hardly a month goes by without a new espionage scandal. Back in 2020, the then president of the German domestic intelligence service compared the situation to that of the Cold War.
Those responsible have apparently not yet sufficiently recognised the extent of the danger posed by commercially collected data in this context. When confronted with the results of our research, the EU Commission stated: „We are concerned with the trade of geolocation data from citizens and Commission officials.“ The Commission has now issued new guidance to its staff regarding ad tracking settings on both corporate and private devices. It has also informed other Union entities and Computer Security Incident Response Teams (CSIRTs) in Member States.
In response to this investigation, members of the European Parliament (MEP) are demanding decisive action. „In view of the current geopolitical situation, we must take this threat very seriously and put an end to it,“ writes Axel Voss (CDU) from the conservative EPP group. Lina Gálvez Muñoz, a Spanish MEP from the Socialist Group S&D, calls for the EU to treat the issue „as a priority security threat, not just a privacy concern“. With regard to the military threat posed by Russia, German MEP Alexandra Geese (Greens/EFA) demands: „Europe must prohibit large-scale data profiling.“
Hundreds of potentially sensitive employees targeted
Our investigation shows how easy it is to spy on top EU staff using commercially traded location data. Based only on the preview data sets available to us, and without paying a cent, we were able to spot hundreds of devices belonging to people working for the European Union in sensitive areas. In the EU Commission headquarters alone, there were around 2,000 location pings from 264 different devices. In the European Parliament, there were around 5,800 location pings from 756 devices.
For example, a movement profile illustrates the daily commute of an EU Parliament employee. They travelled from a community near Brussels to the city centre via the urban motorway. The tracking shows how the employee visits several buildings of the EU Parliament, a supermarket and a restaurant.
Furthermore, we found thousands of location pings in various other institutions, ranging from the Council of the European Union to the European External Action Service and the European Data Protection Supervisor. The preview data sets used for this analysis are just the tip of the iceberg. Paid subscriptions promise large-scale mass surveillance with a constant supply of up-to-date location data.
Even with this limited data, we were able to identify the private addresses of five individuals who work or have worked for the EU, including three people in senior positions. Among the EU staff we identified are a the top Commission official mentioned at the beginning, a high-ranking diplomat from an EU country, and employees of the EU Parliament and the European External Action Service. Initially, they were all suspicious when we contacted them. Some preferred to speak to us only briefly or not at all. None of them wanted to be quoted publicly. Two of the individuals in question confirmed to us that the location data indeed shows their place of residence and workplace, as well as their movements in Brussels. We also found a digital rights activist and a journalist in the data, who confirmed its accuracy.
The data travels along winding paths through an opaque ecosystem, beginning with apps that claim to only track users for advertising purposes. Ultimately, it ends up in the hands of data brokers, and, potentially, anyone who asks for it. These could be advertising companies, journalists – or even foreign intelligence services.
Location data is not anonymous
The data sets offered by data brokers do not contain the names or addresses of mobile phone users who are tracked at every step. Nevertheless, we were able to identify several individuals. This was made possible, among other things, by the so-called Mobile Advertising ID, which is a unique identifier for the online advertising industry that Google and Apple automatically assign to each phone.
Each location in our data sets is linked to such an ID. This allows loose data points to be combined to form detailed movement profiles. Places of residence and work can easily be identified because locations are noticeably concentrated here. Particularly in the case of freestanding houses with publicly visible doorbell signs, it quickly becomes clear whose location data is involved. In some cases, the residents of a house can also be identified online, for example in the telephone directory or through the imprint on their website. Our investigation proves that location data is not anonymous.
Reactions to the Databroker Files in political Brussels are often characterised by surprise or nervousness. Even high-ranking employees responsible for data protection and digital regulation would not have expected the precision of openly traded mobile phone location data.
Urgent warning from NATO
NATO also has its headquarters in Brussels. In our sample data sets alone, there are 9,600 mobile phone location pings on NATO premises, recorded by 543 different devices. The alliance is under extraordinary pressure due to the tense military situation and Russian espionage, among other things. What is its response to the findings of our investigation?
„We are fully aware of the general risks that third-party data collction poses to the Alliance“ writes a NATO representative in French. Measures had been taken to mitigate these risks – but when asked, he would not explain what they were.
The fact that the military alliance apparently perceives such cell phone tracking by the advertising industry as a threat is demonstrated by the urgent request made by the NATO representative to the reporters. „We take the security of our staff very seriously, and trust that you will do your utmost not to publish any information that could harm them,“ he writes. „It is essential that no telephone located at NATO headquarters be identified or associated with named persons, and that no telephone linked to NATO be located in any other place.“
The Belgian military also responded to our research after L’Echo’s team discovered movement profiles on Belgian military sites. „We are fully aware of the problem,“ says the press office. The use of private devices is often already prohibited, but not in military quarters. They are working on a new directive that strongly advises personnel not to use applications that allow conclusions about their place of residence or workplace. However, our investigation shows that location data can potentially leak via almost any app
Wir sind ein spendenfinanziertes Medium
Unterstütze auch Du unsere Arbeit mit einer Spende.
What intelligence services can do with advertising data
Several years ago, a study by the NATO research centre Stratcom (Strategic Communications Centre of Excellence) highlighted that such data poses a threat not only to our privacy, but also to military security. With the help of such data, enemy actors would be able to identify and spy on key military personnel or track military operations.
Neither NATO nor the EU or its member states have been able to find an antidote since then. In 2024, together with Bayerischer Rundfunk, we analysed commercially traded location data from Germany to demonstrate how it can be exploited to identify and spy on high-ranking government officials, as well as members of the military and intelligence services. Using the data, the most important US and NATO bases in Germany could also be spied on. It even revealed visits to brothels. We obtained the data from a US data broker, mediated through a Berlin-based data marketplace.
Similar journalistic investigations from European countries such as the Netherlands, Norway and Switzerland have also proven the problem. The new research by our partner L’Echo today demonstrates how vulnerable Belgium is due to openly traded location data. Police forces, prisons and critical infrastructure, such as nuclear power plants, can be spied on.
The dangerous business of advertising intelligence
If the investigative team was able to target high-ranking EU personnel with just two free data samples and these simple methods, what could well-resourced intelligence services or other malicious actors achieve with commercially available data?
In recent years, a new branch of the global surveillance industry has emerged. It specialises in making data from the online advertising ecosystem available to government agencies. The US company Babel Street, for example, claims to have developed a kind of „Google Maps for mobile phones“ with its service Locate X. The system is said to allow law enforcement agencies to easily track down individuals.
The technical term for this is „ADINT“, which stands for Advertising Based Intelligence. The dangers posed by ADINT, for example from foreign intelligence services, can be described as hybrid threats. This term describes attacks that are not overtly military in nature, such as espionage or sabotage.
Researchers warn: „Extremely worrying“
At the Helsinki-based research centre Hybrid CoE, experts from several disciplines are conducting research on behalf of the EU and NATO into defending against hybrid threats. Regarding the results of our investigation, spokesperson Kiri Peres writes: „Mobile location data could be exploited by hostile actors to facilitate hybrid activities to harm the democratic society and undermine the decision-making capability of a state.“
As Peres explains, it seems „only logical“ for China and Russia to acquire data from the advertising industry. It could be used, for example, to track people who oppose the regime or attend mass protests. High-ranking individuals abroad could be identified and spied on, including politicians and journalists, members of the government, the military, and the secret services. In wartime, data from the advertising industry could be used to track military movements.
Corbinian Ruckerbauer researches surveillance and digital rights at the non-profit think tank interface in Germany. When asked by netzpolitik.org, he expresses considerable doubt that European intelligence services and security authorities are truly aware of the threat posed by mobile phone location data from the advertising industry.
„Neither do government agencies nor parliamentary committees publicly discuss such threat scenarios, nor is there any discussion of what contribution we Europeans would actually have to make in order to tackle this problem in a sustainable manner“, writes Ruckerbauer. He adds that EU states „should develop legal solutions and enforcement mechanisms to restrict this sprawling data market“.
His colleague Thorsten Wetzling from interface writes: „Especially at the current time, when the European security and defence landscape is being tested daily by Russia for possible attack vectors, it is extremely worrying that sensitive location data can still be acquired so easily on the data market to such an extent.“
However, it is worth noting that Western intelligence services and other government agencies are also reportedly using data from the advertising industry. In the USA, their services are used by the ICE deportation troops authority, among others.
In the jungle of data brokers
But how does this data end up in the hands of these companies in the first place? Our previous investigations habe given us unique insights into the depths of the data industry. In our explanatory article, we compare the tangled paths of the data trading ecosystem to a jungle.
It all starts with apps that people give permission to, either consciously or unconsciously, to collect their location data. In order to monetise their services, developers either embed code from tracking companies directly into their apps or offer advertising space to third parties. By doing the latter, they broadcast extensive information about their users to dozens or even hundreds of companies that participate in auctions, bidding for the opportunity to display ads to their target groups. Some use this data not only for advertising purposes, but also as a commodity – which is a tempting offer for data brokers.
The quality of the data varies. Data brokers sometimes present their data sets as larger than they really are, for example by adding fake advertising IDs to real location data. It is therefore possible that the data records available to us with 2.6 million different advertising IDs are actually based on fewer than 2.6 million different devices. Nevertheless, our investigation shows how individuals and institutions can be targeted even with inaccurate data.
The Databroker Files also reveal that many European companies are heavily engaged in the data industry. A data marketplace called Datarade, for example, is an important infrastructure for the industry. It is based in Berlin. Meanwhile, our conversations with developers show that they are often unaware of who their apps share users‘ data with. What they do notice, is the increase in revenue when the number of users increases, whether through payments from tracking companies or advertising revenue.
What tracked people in Brussels say
Only two individuals from our dataset are willing to publicly share their perspective. However, neither of them is employed by the EU. The first is Shubham Kaushik, who works for European Digital Rights (EDRi), an umbrella organisation for digital rights organisations. She volunteered her advertising ID to us – score. She says:
„It felt really invasive. Without my knowledge, personal information about me is out there for anyone with money to buy and access.“. The only way to preserve people’s right to privacy and live their lives freely is to ban the tracking industry.“ Only a single location ping of Kaushik appears in our data records. In contrast, a journalist from the Belgian newspaper L’Echo was tracked several times. The location data showed where he lives and where he had been on holiday. He says:
„I make efforts not to be tracked, but apparently they are not enough. Imagine if I were a journalist writing about China – and China could track and spy on me.“
Data protection as a race to the bottom
How is all this possible when the EU has the General Data Protection Regulation in place? This question shakes the very foundations of the European self-image. Through its comprehensive digital regulation, the European Union has sought to demonstrate how it can democratically shape the digital world by finding a fair compromise: Economically oriented forces got a regulation that did not contain any harsh prohibitions, but merely rules and guidelines for data processing. Fundamental rights orientated forces obtained individual rights, such as the right to information or deletion of data, as well as strengthened supervisory authorities.
Much of this is held together by the instrument of consent. It is the legal basis for many cases of data processing and is intended to give people freedom of choice. Particularly when it comes to data processing for apps and online services, the idea was that people do not actually have to consent – but they can, as long as they are informed and do it voluntarily.
The idea was that this would lead to a competition and a race to the top, resulting in only trustworthy providers receiving consent. In the words of the the EU Commission: „Data protection as a competitive advantage“. In practice, however, it has become a race to the bottom, with companies doing everything they can to collect as much consent as possible. They trick users with manipulative design or simply give them no choice but to consent to tracking. The Databroker Files are a direct consequence of this competition for the worst data protection.
Illegal on paper
On paper, there is little doubt among data protection experts that the data broker business we have uncovered is illegal. This view was expressed, for example, by the Federal Data Protection Commissioner of Germany, Louisa Specht-Riemenschneider.
The problem begins with the issue of consent. According to the unanimous legal interpretation of data protection authorities, consent is the only legal basis on which advertising tracking can be based. In addition to the aforementioned problems with voluntariness, the main issue here is that the consent is often not informed. For instance, anyone who has agreed to the privacy policy when installing a weather app would not be able to understand where their data ends up, especially if it is being traded freely.
This also undermines the rights of data subjects, since they cannot make requests for information or deletion to companies they are not familiar with. In addition, location data can reveal sensitive personal information that is specially protected by the GDPR. This could include location tracking in rehab clinics, religious buildings, party and trade union buildings or queer sex clubs, for example.
Another issue is the purpose limitation, a principle of the GDPR, according to which data may only be used for the purposes for which it was collected. However, with data brokers, data that is allegedly only collected for advertising purposes becomes a commodity without a more precisely defined purpose. According to data protection experts, this constitutes a clear violation.
The problem of GDPR enforcement
There are two related reasons why the authorities have not taken stronger action against the system of advertising tracking and data trading. Firstly, the authorities only tend to take action when they receive complaints from citizens, and citizens can only complain about companies they know. This is why there are so many complaints about faulty cookie banners, but not about the invisible infrastructure behind them. Tracking companies have made themselves comfortable in the shadow of the GDPR, which is why Irish data protection activist Johnny Ryan coined the term „data protection free zone“ for everything that happens behind the cookie banner.
Secondly, European data protection authorities are often still inadequately equipped. They receive so many complaints from citizens that they have hardly any resources left for conducting strategic ex officio investigations. Additionally, the authorities are primarily legally equipped and lack the technical expertise and personnel required for more complex analyses.
In Germany, our reporting has triggered first investigations and consequences from state data protection authorities. However, the Data Protection Commissioner of Berlin, Meike Kamp, is also calling for legislative support to get the systematic problem under control. According to her, “clearer statutory regulation of online tracking and profiling” would be “desirable.”
Her colleague Bettina Gayk from North Rhine-Westphalia says that, as a data protection authority, she can only take action in individual cases. “A truly comprehensive impact could only be achieved by a legal ban that precisely defines permissible processing of location data for specific purposes, tightly limits it, and fundamentally prohibits any personal or identifiable onward sharing of the data.” She warns that location tracking in hospitals or at political events, for example, can reveal particularly sensitive data. “This kind of thing must never become a commodity.“
From the siding to the graveyard
Can the European Union muster the strength for further digital regulation in the current situation? Laws such as the AI Act, the Digital Services Act and Digital Markets Act are under massive pressure from companies and countries within and outside Europe. When discussing a reform of the data protection, it is almost always just about making things easier for businesses.
This spring, the EU Commission buried a proposed regulation intended to solve the problem of consent online, after years of stagnation. The ePrivacy Regulation was actually due to be adopted in 2018 to supplement the GDPR, which came into effect that year. Had the EU Parliament had its way, users would have been able to decide centrally, in their browser or smartphone operating system, whether and by whom they wanted to be tracked. This decision would have been legally binding.
The prospect of users actually being able to decide who receives their data online caused sheer panic in the data industry. Online advertising companies, Silicon Valley corporations and time-honoured European media companies joined forces in a broad alliance to prevent the regulation. They compared it to a nuclear bomb for the internet and warned of the end of free – meaning ad-financed – journalism on the internet.
With success: Under the constant fire of their lobbying initiatives, the project was pushed further and further onto the back burner. Although the European Parliament adopted an ambitious draft in 2018, the member states were unable to reach an agreement in the Council for years. In spring 2025, the EU Commission finally withdrew the proposed regulation.
The Digital Fairness Act gives little hope
The EU Commission has vaguely promised a follow-up initiative, but it is uncertain whether it will actually materialise. First up is the Digital Fairness Act, which Commission President Ursula von der Leyen first announced at the start of her second term of office.
The law is intended to close gaps in digital consumer protection. The Commission collected feedback on this in a public consultation until October; the wish list of possible regulations is long. It remains to be seen whether the problem of consent, advertising tracking and data trading will be included.
Parliamentary circles say that hopes should not be too high. It is considered unlikely that comprehensive regulation will be put on the agenda in the current political climate, in which reducing bureaucracy is the order of the day.
Civil society organisations such as the Chaos Computer Club and the Federation of German Consumer Organisations are calling for an approach that tackles the root of the problem head on: a blanket ban on advertising tracking and data trading.
In fact, there was already a cross-party initiative in the EU Parliament in 2020 that aimed to achieve just that. The „Tracking-Free Ads Coalition“ wanted to enshrine a corresponding ban in the Digital Services Act (DSA) being negotiated at the time, but failed to gain a majority in favour. Today, the DSA only prohibits targeting with data relating to minors and sensitive data, such as religion, sexuality, health or politics.
MEP: „Ban tracking completely“
In response to our investigation, the European Commission prefers not to talk about new regulation. „We already have put strong legislation in place in the EU, namely the GDPR,“ writes a spokesperson. He states that it is a matter for the national supervisory authorities, including the national data protection authorities, to determine whether EU data protection laws have been breached. „The Commission stands ready to cooperate with those authorities.“
Axel Voss, a German digital politician from the conservative EPP group in the EU Parliament, believes the EU should take decisive action in light of the investigation. „We need a more precise definition of the use of location data and therefore a clear ban on trading particularly sensitive location data for other purposes“. For reasons of data protection and security, he believes that „strict restrictions are necessary, especially where movement or behavioural data allow conclusions to be drawn about sensitive areas“. The aim must be to „protect citizens and security interests without unnecessarily burdening European companies“.
Voss also calls for „a Europe-wide registration obligation for data traders and consistent enforcement of existing data protection rules“. In contrast, he is cautious about a comprehensive ban on tracking and profiling for advertising purposes: „A complete ban is a far-reaching step that needs to be carefully considered.“ However, it must be clear that location data should not be treated as an „economic object“.
Spanish MEP Lina Gálvez Muñoz commented on the research on behalf of the Socialist Group S&D in the EU Parliament. With regard to data trafficking, she writes: „In a context of escalating geopolitical tensions, this poses direct threats to national and collective security.“ The EU has „a good legal framework as a starting point,“ she continues, citing the Cyber Solidarity Act and the Cybersecurity Act as examples. „We need to keep working on strengthening and adapting it to the current geopolitical context as well as on implementing and enforcing it.“ Gálvez Muñoz also believes that the EU needs to expand the scope of the existing legislation.
Alexandra Geese, a German MEP from the Green Group, reiterates the call for a ban on tracking and profiling for advertising purposes. „I have championed such a prohibition for years,“ writes Geese. „Detailed knowledge about individuals held by data brokers constitutes a national security risk.“ She warns: „If the bulk of European personal data remains under the control of U.S. companies and opaque data brokers, defending Europe against a Russian attack becomes markedly more difficult.“ She sees „compelling grounds to ban tracking outright and to create a new, privacy respectful advertising ecosystem“.
Team L’Echo: Nicolas Baudoux, Benjamin Verboogen. Team Le Monde: Martin Untersinger, Damien Leloup. Team BNR: Lisanne Wichgers, Bart van Rijswik. Team BR: Katharina Brunner, Rebecca Ciesielski, Maximilian Zierer, Florian Heinhold. Team netzpolitik.org: Ingo Dachwitz, Sebastian Meineck, Maximilian Henning, Anna Biselli, Daniel Leisegang.
All you need to know about how adtech data exposes the EU to espionage
Threat to privacy and national security. – Figure: Pixabay; Fog: Vecteezy; Montage: netzpolitik.org
A German version of this article was published under the title „Das Wichtigste zur Spionage-Gefahr durch Handy-Standortdaten in der EU“.
New datasets containing millions of mobile phone location data reveal how easily the European Union can be spied on using data from the advertising industry. The investigative team obtained the data as free samples offered by data brokers to potential subscribers – and was able to use them to trace the movements of high-ranking EU personnel. The dataset even includes location pings from inside NATO headquarters in Brussels.
„We are concerned with the trade of geolocation data from citizens and Commission officials,“ the European Commission said in response to the findings. Members of the European Parliament describe the situation as a threat to Europe’s security and are calling for legislative action to curb rampant ad tracking and the largely uncontrolled trade of personal data.
The investigation published today together with BR, L’Echo, Le Monde and BNR is part of the Databroker Files. In this project, netzpolitik.org, Bayerischer Rundfunk, and international media partners have been shedding light on the global data industry since summer 2024.
Here’s an overview of the key questions regarding the current status of the investigation:
1. Who is affected by the risk of espionage from mobile location data?
No place is safe from surveillance using commercially traded mobile location data. Altogether, the investigative team now holds 13 billion location records from almost every EU country, the United States, and many other parts of the world.
For the part of the investigation focusing on the EU, we analysed 278 million location pings from Belgium, covering a few weeks in both 2024 and 2025. At the Berlaymont building in Brussels – the European Commission’s headquarters – the dataset showed roughly 2,000 location pings from 264 different devices. Within the European Parliament, there were about 5,800 pings from 756 devices, in the NATO headquarters there were 9,600 location pings from 543 devices. The Council of the European Union, the European External Action Service, the European Data Protection Supervisor, and other EU institutions are also affected.
All records are linked to unique device identifiers, allowing for the reconstruction of movement profiles that often reveal a person’s workplace, home address, and other places they frequent. Such data enables deep insights into people’s lives – from the grocery stores they frequent to trips abroad, and even visits to clinics or brothels.
Even the limited datasets that we received as free samples led us to identify the home addresses of five individuals who are currently or have previously worked for the EU, including three in senior positions. Among the EU staff we identified are a top official at the Commission, a high-ranking diplomat representing an EU member state, and employees of the European Parliament and the European External Action Service. We also found data linked to a digital rights activist and a journalist.
Earlier investigations had already shown that similar datasets could be used to spy on senior government officials, military sites, police departments, and even intelligence personnel in Germany – as reported in previous Databroker Files research.
Independent investigations by colleagues in the Netherlands, Norway, Switzerland and Ireland reached similar conclusions, showing that even critical infrastructure, such as nuclear power plants, can be targeted.
2. Why is the trade in tracking data dangerous?
The uncontrolled trade of such data not only poses an unprecedented threat to users’ privacy and informational self-determination. In times of an increased risk of espionage, it also endangers Europe’s security. As early as 2021, a study by NATO’s Stratcom research center warned that commercially traded advertising data could be exploited for espionage. Using such data, hostile actors could identify key military personnel, track them, or even monitor military operations. Other potential risks include the blackmail of high-profile individuals and the preparation of sabotage.
At the Helsinki-based think tank HybridCoE, experts working on behalf of the EU and NATO study ways of counter hybrid threats. In light of our findings, spokesperson Kiri Peres stated: “Mobile location data could be exploited by hostile actors to facilitate hybrid activities to harm the democratic society and undermine the decision-making capability of a state.” It seems “only logical,” she added, that China and Russia would use advertising data for such purposes. In wartime, data from the advertising industry could help track military movements.
In recent years, a dedicated branch of the global surveillance industry has emerged that specializes in harnessing data from the adtech ecosystem and data brokers for intelligence services and government agencies. The technical term is ADINT, short for advertising-based intelligence.
The Belgian datasets once again illustrate how extensively the advertising industry collects near-meter-accurate location data from millions of people and distributes it globally through data brokers. This represents a new form of mass surveillance that is largely invisible to the public and enables deep intrusion into people’s private lives.
3. How does sensitive data end up with data brokers?
The sometimes meter-accurate location data originates from smartphone apps and is allegedly collected only for advertising purposes. However, our investigation shows that such data can leak through virtually any commercial app. In January 2025, we reported on a dataset containing 380 million mobile location data points from 137 countries and linked to around 40,000 different apps. Within the advertising ecosystem, hundreds of companies often enjoy largely unrestricted access to such data. Data brokers acquire it, bundle it into packages, and sell it on.
These datasets are marketed on data marketplaces. One key player identified in our research is Datarade, based in Berlin, whose platform has been used by several journalists to contact providers offering massive troves of European location data. Datarade itself does not process or sell the data, but rather facilitates contact between buyers and sellers.
Apple and Google enable this form of tracking by assigning phones unique identifiers known as Mobile Advertising IDs.
Several players in the location data trade are based in the EU. Journalists have repeatedly made contact with brokers via the Berlin-based Datarade marketplace. Germany’s most popular weather app, WetterOnline, shared precise location data with third parties without valid user consent, as confirmed by the competent data protection authority following our reporting. The Lithuania-based marketing firm Eskimi was reportedly a source of mobile location data from Germany for a U.S. data broker, although Eskimi denies this.
4. Why doesn’t the GDPR stop data brokers?
Data brokers, tracking companies, and app operators involved in the trade of mobile location data claim that their business is legal and that they rely on users’ supposed consent. However, data protection authorities and legal experts – including Germany’s Federal Commissioner for Data Protection, Louisa Specht-Riemenschneider – disagree. The data trade uncovered in the Databroker Files is not compatible with the GDPR for several reasons.
Under the General Data Protection Regulation, consent must be informed to be valid, meaning users must know who is receiving their data and for what purposes. Yet, location data is often passed on to hundreds of entities and resold multiple times. The GDPR’s purpose limitation principle is also violated when data become a traded commodity without any defined purpose. Moreover, data subject rights, such as the ones to access, correct, or delete personal data, are effectively nullified.
Location data can also reveal information considered particularly sensitive under the GDPR, such as visits to medical facilities, political party headquarters, religious institutions, or trade union offices. Since mobile data can also disclose home addresses, it is rarely anonymous.
Until our investigations, data protection authorities had apparently not grasped the full scale of the problem. They are underfunded and typically act only when citizens file complaints about specific data processors, barely scratching the surface of the issue.
5. What needs to be done to solve the problem?
In response to our findings, civil society organisations such as Germany’s Federation of Consumer Organisations and even the Federal Ministry for Consumer Protection have called, in response to our findings, for a ban on tracking and profiling for advertising purposes, which woul cut off the data trade at its source.
The European Commission expressed its concern in response to the investigation but saw no immediate need for new regulation. Instead, it argues that the GDPR should be enforced more effectively by national supervisory authorities.
For the conservative European People’s Party (EPP), German MEP Axel Voss (CDU) commented: „In view of the current geopolitical situation, we must take this threat very seriously and put an end to it.” The EU, he said, must act decisively: “We need a more precise definition of the use of location data and therefore a clear ban on trading particularly sensitive location data for other purposes“. He also called for a Europe-wide registration requirement for data brokers and for the consistent enforcement of existing data protection rules.
For the Socialists and Democrats (S&D), Spanish MEP Lina Gálvez Muñoz stated that while the EU already has a strong legal framework in place, “we need to keep working on strengthening it and adapting it to the current geopolitical context as well as on implementing and enforcing it.“
For the Greens/EFA group, German MEP Alexandra Geese commented: “If the bulk of European personal data remains under the control of U.S. firms and opaque data brokers, defending Europe against a Russian attack becomes markedly more difficult.” She added: “Europe must prohibit large scale data profiling.“
Contact the investigative team and find all netzpolitik.org coverage of the Databroker Files here. Use your browser – for example, Firefox’s built-in translation feature – to quickly translate our German texts into English.
Brüssel räumt ein: Substanzielle EU-Gelder sind an Spyware-Hersteller geflossen
Die EU-Kommission hat angekündigt, sie werde „unverzüglich“ die Finanzierung von Einzelpersonen oder Organisationen stoppen, die in „schwerwiegendes berufliches Fehlverhalten“ verwickelt sind. Hintergrund ist eine Recherche von Follow the Money (FtM), wonach in den vergangenen Jahren EU-Gelder in Millionenhöhe direkt an kommerzielle Spyware-Firmen geflossen sind.
Weiterlesen nach der Anzeige
Das Portal FtM deckte im September in Zusammenarbeit mit anderen Medienpartnern auf, dass die Spyware-Industrie hohe Subventionen von der EU kassiert und gleichzeitig deren Bürger überwacht. Demnach hat etwa die Intellexa-Gruppe, die den Staatstrojaner Predator entwickelt, über mit ihr verbundene Firmen öffentliche Finanzspritzen insbesondere über Innovationsprogramme eingesackt. Cognyte, CyGate und Verint sollen als weitere Produzenten von Überwachungstechnologien wie Spyware ebenfalls finanzielle Unterstützung aus EU-Quellen erhalten haben. Deren Lösungen werden häufig im Kontext von Menschenrechtsverletzungen genannt.
39 EU-Abgeordnete aus vier Fraktionen forderten daraufhin in einem gemeinsamen Brief von der Kommission konkrete Antworten. Die Volksvertreter monierten, die EU finanziere – offenbar ungewollt – Instrumente, die in Mitgliedstaaten wie Polen, Griechenland, Ungarn sowie autoritären Drittländern für Repressionszwecke eingesetzt wurden beziehungsweise werden. Dies untergrabe die Grundrechte und die Demokratie.
Die Kommission hat es laut dem Schreiben offensichtlich versäumt, die Vertrauenswürdigkeit, Eigentümerstruktur und Menschenrechtskonformität der Unternehmen zu prüfen. Die geforderten Endnutzer-Klauseln oder Dual-Use-Kontrollen, ob ein Produkt sowohl zivil als auch militärisch und polizeilich missbraucht werden könne, würden anscheinend nicht wirksam durchgesetzt. Die Enthüllungen zeigten, dass die Brüsseler Regierungsinstitution Empfehlungen aus dem parlamentarischen Untersuchungsausschuss zu den Spyware-Skandalen in dem hochsensiblen Bereich nicht ausreichend befolge.
Kommission legt die Hände in den Schoß
In ihrer Stellungnahme erläutert die Kommission laut einem Newsletter von FtM, dass Strafverfolgungsbehörden und Geheimdienste Spyware „rechtmäßig für legitime Zwecke einsetzen“ dürften. Sie versäume es jedoch, alle EU-Programme aufzulisten, von denen Überwachungsunternehmen profitiert haben. Es fehlten insbesondere Angaben zu Zuschüssen aus dem Europäischen Sozialfonds und einem weiteren Finanztopf, die an die italienische Überwachungsfirma Area vergeben worden seien.
Auch Geldflüsse an den berüchtigten Spyware-Hersteller Hacking Team erwähne die Exekutivinstanz nicht, heißt es weiter. Selbst die jüngsten Überweisungen aus dem Europäischen Investitionsfonds (EIF) an die israelische Spyware-Firma Paragon Solutions, die derzeit im Zentrum eines Skandals in Italien steht, blieben unerwähnt. Anstatt neue Schutzmaßnahmen vorzuschlagen, verweise die Kommission nur auf den bestehenden Rechtsrahmen zum Schutz vor dem illegalen Einsatz von Spyware.
Weiterlesen nach der Anzeige
Die EU-Exekutive „versteckt sich hinter vagen Verweisen auf ‚EU-Werte“, kritisiert Aljosa Ajanovic Andelic von der Initiative European Digital Rights (EDRi) die Antwort gegenüber FtM. Dabei gebe sie offen zu, „dass europäische Gelder Unternehmen finanziert haben, deren Technologien zur Spionage gegen Journalisten und Menschenrechtsverteidiger eingesetzt werden“. Das belege das völlige Fehlen effektiver Kontrollmechanismen. Die Grünen-Abgeordnete Hannah Neumann rügt, dass die Kommission dem Ausschussbericht in den vergangenen zwei Jahren kaum Taten habe folgen lassen.
