Data protection

A loss-making venture for democracy?

Shortly after the attacks of 11 September 2001, the first entrepreneurs began systematically sifting through and buying up customer data from private companies in order to sell the personal profiles derived from it to the US security authorities. This is how Byron Tau describes it in his book "Means of Control". What was an ad hoc practice back then is now an industry with its own technical term: ADINT, short for Advertisement-based Intelligence: intelligence gathered from advertising data.

The data pool for this is growing ever larger. Almost every free app constantly sends data to the advertising ecosystem in the background: the device’s location, a unique advertising ID, interests, contacts. Data brokers buy up these streams, merge them and use them to create profiles: where someone lives and works, who they meet and which bar they go to. The data is considered anonymous. Yet anyone familiar with the patterns can quickly identify an individual from it. Netzpolitik.org and Bayerischer Rundfunk have demonstrated just how far this goes with their Databroker Files. The journalists obtained billions of location data points from Germany and used them to trace the movement patterns of soldiers and intelligence service staff, right down to the grounds of barracks and intelligence agencies.

For an intelligence service, such insights are worth their weight in gold. If it were to obtain this information through conventional means – for example, by making an enquiry with a mobile phone provider – it would need a court order, a justification, and would have to be subject to scrutiny by independent bodies.The German BND Act regulates each of these steps. If, however, it purchases the same information from a data broker, none of this is required: no explicit legal basis, no authorisation procedure, and no specific oversight mechanisms.

This loophole is currently gaining political significance. At the beginning of July, the German government published the first official draft of the most significant reform of intelligence service legislation in years – just under 700 pages – granting far-reaching new powers to the BND and the Federal Office for the Protection of the Constitution. Against the backdrop of this debate, a study by Corbinian Ruckerbauer and Thorsten Wetzling has been published for the Global Innovation Hub of the Friedrich Naumann Foundation for Freedom. In the study, the authors analyse the field of intelligence data procurement by addressing two questions: What risks arise when intelligence services purchase data on the open market – particularly in model democracies such as Germany or Taiwan? And how should their purchasing be regulated?

Intelligence services and the data market: a legal grey area

At the end of 2025, the Research Services of the Bundestag noted that such purchases were no longer an exceptional occurrence, but were increasingly becoming part of the authorities’ information management. The Federal Government is unwilling to say whether, or how often, German intelligence services make such purchases. It cites the need for secrecy in the public interest.

This temptation is understandable. Russia is waging war and hacking German authorities, whilst China is threatening Taiwan and conducting disinformation campaigns. So why, of all places, should democracies not make use of sources from which their opponents have long been drawing?

It critically highlights two aspects. The first concerns fundamental rights. Anyone who purchases location and communication data on a massive scale is infringing upon the confidentiality of telecommunications, just as traditional surveillance would, only without the safeguards required for such surveillance. Depending on how the data is used, other rights may also be affected: if the participants in a demonstration are identified via location data, freedom of assembly is compromised; if journalists’ movement patterns can be used to trace their research and expose their sources, freedom of the press is affected. The authors consider the argument that users have consented to the resale of their data via the terms and conditions to be untenable, given the opacity of the data market. Without a legal basis, such purchases could potentially be unconstitutional.

The second objection should also be taken seriously by security policymakers: the market has no sides. The same movement profiles of German soldiers that journalists were able to purchase can just as easily be bought by a Russian or Chinese intelligence service. Such data can be used to identify who works for an intelligence service or who might be vulnerable to blackmail. Furthermore, the quality of the data is not regulated and could also be deliberately manipulated. Any state that buys into this market is fuelling an industry that is, at the same time, its weak spot.

The second case study on Taiwan illustrates just how real this threat is. Leaked documents from companies such as Zhenhua, i-Soon and Knownsec show how publicly available and hacked data, as well as purchased datasets, are combined to create detailed profiles of people and infrastructure. Among other things, 459 gigabytes of Taiwanese road planning data were found at Knownsec. The commercial data market and state-directed espionage are not separate worlds.

Don’t ban it, but use it in a controlled manner

So what can be done? The authors are not calling for a ban on these services purchasing data. They are calling for what is taken for granted in the case of any other surveillance measure: a legal basis with clearly defined purposes and a requirement to state reasons; an independent body to approve sensitive purchases in advance; and a supervisory authority that can also scrutinise the use of the data. This is not a utopian idea. Since 2024, the UK has required written authorisation for access to certain commercial data sets, whilst in Norway the supervisory body can even summon employees of private companies to appear before it.

According to the authors, clear rules do not weaken the services; they strengthen them. They provide legal certainty for staff, instil confidence in the public, and lend legitimacy to the security framework. The forthcoming reform of intelligence legislation would be the ideal opportunity to close this gap. If this opportunity is allowed to pass unused, democracy will pay the price twice over: both in terms of fundamental rights and in terms of the very security that the purchase of data had promised.