Berlin (CNSNews.com) – The news that hundreds of German politicians’ personal information was leaked online for more than a week before action was taken, has caused widespread criticism direct at the federal cybersecurity office (BSI), which now also stands accused of trying to dodge responsibility.
The attacks have prompted speculation that elements on the far right may be responsible, given that all political parties except for the Alternative für Deutschland (AfD) were targeted, along with journalists and public figures known for anti-far right activism.
Targets included members of the federal parliament (the Bundestag) and the European Parliament, as well as federal President Frank-Walter Steinmeier, German Chancellor Angela Merkel and her entire cabinet.
The data was disseminated in the lead-up to Christmas via a Twitter account that has since been taken down.
Between December 20 and 28, the Twitter user purportedly based in Hamburg shared links to datasets containing the personal information of lawmakers including phone numbers, addresses and credit card information, as well as internal party documents, some dating back several years.
The identity of the account holder, motives and method of acquiring the data are still unknown.
Targeted politicians criticized the BSI – the federal office in charge of computer and communication security for the government – because they were only made aware of the breach last weekend.
In a statement Saturday, the agency defended its actions, saying it could not have connected what were assumed to be isolated individual cases until the entire data release became public last week.
(The leaks remained largely unnoticed at first, possibly in part because the account’s followers consisted mostly of bot accounts. After a prominent German YouTube user shared the information in a video clip, media picked up the story and the BSI was finally informed by a newspaper on Friday.)
The BSI claimed it was not responsible for protecting the compromised data, and that it “can only act in an advisory capacity and provide support when it comes to securing party or private communication between lawmakers.”
Politicians reacted strongly to the BSI’s stance.
“It is outrageous that stolen data was present for days on the Internet and the competent authority did nothing to inform and protect those affected,” Bundestag vice president Thomas Oppermann, told the Bild am Sonntag newspaper.
There were “obviously serious shortcomings in the coordination of the security authorities,” said Oppermann, who is a member of the Social Democrats (SPD), Merkel’s junior coalition partner.
But Armin Schuster, of Merkel’s Christian Democratic Union (CDU) blamed the problem on the fact lawmakers had limited the jurisdiction of the BSI in the past.
He told the Welt am Sonntag that, as a result of those imposed restrictions, he could understand the BSI’s caution.
“I think it is necessary that the BSI be actively involved in IT defense of the Bundestag in the future,” Schuster said.
The leak has prompted a government review of security policy, as well as tougher security regulations for software manufacturers and Internet platforms.
Justice Minister Katarina Barley said the government was examining “the extent to which stricter legal requirements are useful and necessary" and State Secretary Günter Krings said it would also examine strengthening the ability to trace perpetrators.
Thorsten Frei (CDU) said the incident demonstrated that data security is underrated in Germany. While the BSI had a budget of around 110 million euros ($125.3 million) in 2017, Frei said the U.S. would likely have devoted around 20 billion euros ($22.8 billion) to the task.
"That is out of all proportion to the actual danger," he told the Stuttgarter Zeitung.
Non-politician targets of the data leak include satirist Jan Böhmermann, who is running a campaign against extremist right-wing rhetoric online, and journalist Rayk Anders, who produced a documentary about radical right-wing trolls on social media.
Despite speculation of far-right motivation, no party or organization has made any claim of responsibility. The AfD has yet to make any public comment.