 Directly ahead of us is the maybe most exciting talk of this year's RC3 with a huge impact on the civil society. One of our speakers has been active in Hamburg for a long time and in the tailor shopping, Snoopy, is in CCC Cologne and stopped the cameras within Reclaim Your Face and the website ReclaimYourFace.eu is very interesting indeed. There is an initiative against biometric surveillance and Cantorkel and Snoopy, they used Fragt in Start, a German website for Freedom of Information Act inquiries, so they contacted a lot of departments. It's about video surveillance, biometrics and also the handling of biometric data also for some science projects. So, hello Cantorkel and Snoopy. Yeah, thank you for the nice introduction. I will sometimes say let's switch to the next slide, such as now. Snoopy and I, within the last year, we had a lot of Fragt in Start inquiries. This is not a talk about that, not done by Fragt in Start. But I have the logo because without this very nice platform we couldn't have done what we did. So, thanks to them, a big thanks to them. So, next slide please. In this talk we will talk about four inquiries in more detail and also the initiative stopthecameras.org. So, kamerastoffen.org in German. Why did we do this? What did we ask for in detail? And a short summary. Then Snoopy will talk about a very, very big inquiry using the platform Fragt in Start. We asked almost 200 police departments in Germany and often about video surveillance. And in the end we'll talk about what we learned and what we might improve upon ourselves. Links and everything we mentioned will be in the description of the talk. Most of it is in there already and many things will be added later. So, let's start with the first inquiry. How is it that we make those inquiries? So, we read on maybe netpolitik.org in English that an energy provider wants to help add surveillance to the public space. So, video surveillance in the public space is not nice in itself and give that to a private energy company. Makes it even worse. So, we became curious. We wanted to know more about the background and so we opened Fragt in Start.de. So, this is what it looks like and we do it once for an example. So, in this case I entered on the web page that I would like to ask the city of Karlsruhe. And then you click on search, suchen in German. And then I formulated a question, a request. So, I tried to give it a short but meaningful title, use the standard text and just put in which documents specifically I would like to have. At that moment I didn't even know if those documents exist but I just assumed they would because it's about video surveillance in the public space. So, I thought there must be a risk assessment for this. And if the city works together with a private company then there should be a contract as well. Okay. So, if we click through, we get a preview of the request of the inquiry before actually sending it. Do the next click. It is on its way to the city. In this case I didn't only request information from the city but also the data protection office of the state Baden-Württemberg, the LFDI. Also the ministry of the interior. And so, because I already knew that they are involved in some form. And the LFDI said no, there is no documents on that. Even though, even publicly, it was claimed that the LFDI tested the system. So, this was surprising and the ministry of the interior answered as well. And it was even more surprising because they gave us the estimation of the LFDI. And they said, yeah, what happens here should be fine. The city cards itself didn't provide any documents to us, no contract, nothing else because it was still in planning so they couldn't provide anything. There was nothing to be provided yet. So, even though the results of the request were miscellaneous or mediocre, it was still a success because it turned out that Entropia EV became aware of this project. Before it was discussed in the regional local council, they told them why it's a damn bad idea. And then, on the next day, there was the voting and the big headline was that it voted against this automated video surveillance. Well, to be completely transparent, one would have to say that it didn't have enough votes in favor and was therefore failed. But still, that's a very good result for us. Now, let's get to the next request. This is a nice project that we have in bad memory. The pilot project facial recognition at the Berlin Sudkreuz train station. The results were more than mediocre and showed that what was planned in terms of face recognition was pretty bad. It turned out pretty bad and the police still sold it as a success. I wasn't too moved by that project, but I stumbled across this right here. I like searching the Federal Gazette for some keywords and this got into my attention. There was a question in how far German police officers are deployed to foreign missions. And there was this one line that said that police officers were stationed abroad for the continuation of the project facial recognition at the Prague airport in Czech Republic. So I contacted the Federal Police because they were involved in the facial recognition project in Berlin. I wanted some documents about the planning of that project and I didn't get any results because apparently this was only informal information. So I became skeptical because I couldn't imagine that several police officers would travel to Prague and there would be no documentation about that. I also talked about that with a member of the Bundestag and the result was a written request that also got a contentless answer and another request that also didn't lead to any promising results. I still didn't know what this police deployment in Prague was all about. So the questions and answers weren't just about this police exchange, which was another request, but the result was that the Federal Criminal Police was involved again with the answer that this was an informal meeting without documentation. But still I didn't believe that police officers just go to Prague just like that without any documentation. I contacted some friends at NTO Jure in Czech Republic because Czech Republic also has an information freedom act and we also didn't get any information there so maybe I was just too skeptical or too pessimistic but maybe this was all on purpose so that we wouldn't be able to find out anything about it. I would have wished for some more results from this meeting. You can see that I sometimes search Federal documents for certain keywords and another contained a note on facial recognition systems that should be looked into and that sounded interesting. I wanted to read the project report so I made a request and this request was successful and this is what I got. It's an evaluation report. I even got it on time. But it's not the original report but you can see the water sign. It's a copy that was modified for this request. The names of companies were replaced by letters so I couldn't know which companies were involved in that. But something else was very interesting. I won't go into the technical details about which company made a lot of profit but the first part where the scope of the study was mentioned and it said that 3 million half profile pictures were analyzed and 5 million frontal face pictures. The Federal Criminal Office just gave the Fraunhofer Institute 8 million face pictures. I have my doubts as to whether this is legal. I think there would have been other means to review that software and this is why I contacted the Federal Data Protection Officer in April 2021 and in December 2021 I sent a follow up question. Let's move to the next project G20 in Hamburg. That's a few years ago but still it's very much important to us because in 2020 over a million terabyte in image and video material has been collected by the police for biometric evaluation. The software B-Demo was used with that and the Hamburg Data Protection Officer had his doubts that this was all in due process and he asked the police to delete that database which did not happen. The police just ignored the data protection officer. They even sued him. The litigation went to the next instance and still hasn't been finished yet. There were some reports in the press about the case but I still sent a request about it. My first request was erroneous. I asked for the data protection effect assessment and this happened before the GDPR was published or entered into force so an effect analysis was not necessary then but I got counseling from the Data Protection Officer which was very helpful so I asked for certain documents that were mandatory according to the old regulations and I also got some documents with the help of the Hamburg Data Protection Officer and some other documents I wasn't able to get. One document that was very interesting was the so-called Errichtungsanordnung which was only a draft version and it's therefore excluded from the information obligation but I of the opinion that this was no longer a draft even though it said draft on top of it but what was even more interesting is that over the scope of a few years a biomedical database was operated by the police without the document mandating in it the so-called Errichtungsanordnung was ever signed. So normally if a file is being kept for three months or more you would have to have such an order signed and this wasn't signed. Now this takes us to Cologne. Yes, thank you. I will report on Kameras Stoppen which is an initiative from Cologne against the video surveillance by the police president of Cologne. The police president of Cologne has after the Cologne Sylvester night the police president and his office after the night 2015 to 2016 the Sylvester night, the New Year's night they increased surveillance considerably and we are really working against it. Within the initiative I said a few demands for information by now it's 17 of them I will add a link to those and the problem here is that we never really received an answer from the police. The police always said no because of public safety we cannot give out information and also the data protection office help didn't really help us and the police remain stubborn and doesn't want to give up a drop of information. Sometimes they take another reason then public safety, there is data protection laws that they like to abuse but when in doubt they like to quote public safety and we thought because we got some experience with demands what is it like in other cities and so we had some ideas and we know from Praktinstadt asked the state a website that you can ask they have a tool where you can ask several cities at once so you have to register once that's relatively simple and easy and then we sent out a very big inquiry because police is complicated in Germany it's in the domain of the state and there is a lot of local police things happening for example there's different names so you can't use a text filter to get all police departments from this list and we clicked a lot until we thought well we got all the police we found all the police that might help us and then we created our inquiry we all in all 195 police departments were found and then we also sent them an inquiry in the text, this is the text that we sent with our experiences we learned a lot ideally we would have everything but it's difficult to write that in your inquiry so you have to specify it a bit more so the police know what exactly we want to have so the most important things are where are video cameras so where is it, what does it see and how much energy does it take then as we reported on earlier then we wanted that we wanted the installation orders and we wanted the assessment of risk for data protection and how far are the capabilities of AI are similar intelligent video surveillance possibilities and then we wanted all the administrative stuff so we can check that everything is in order then we sent that out and this is the results that we got we can see on the left that 70 answers that we got and with 125 departments we never received anything no life sign we reminded some of them still no answer and they just play death for time reasons we spent some time and maybe not all of them not all of the data protection offices we didn't include all of those and asked for help and mediation but maybe next year there will be a talk about that but if we look at these results in detail then we can see that it's a good news the answers we got only three refused outright so 13 refusals and the other answered to some capacity that if we look at those more closely it doesn't look as nice not one of them was complete even if one department or the other sent us 95 or 99 of the information that we wanted to have all of them are just partially filled out and eight of them were mostly not many then the refusals we already had then there were a few that answered that they don't have any video surveillance also a good hint so we know that they don't have anything at the moment then depending on the state there is police departments that say we don't really take care of that and we don't like to answer those requests send it to the ministry or the office of interior and then a few of them grant to a halt in the process of being answered so we got an answer but then while talking they stopped answering at some point there are several reasons for that why it might be an administration I don't know but a few also we couldn't follow up on because maybe sometimes they demanded confusing fees or we had no further ideas and we just gave up a few of those as a last category there is technical mistakes or errors we have a few where the email address just didn't work but it was an answer and that's where we put it so the successes I want to show one of our successes was in Ofenburg in the state of Baden-Württemberg there we got almost all information from the police to existing video surveillance installations the image is a small cut out of the risk assessment that the technological it describes the technological side you see how the police try to do everything properly at least on the diagram and in addition there is a lot of text and instructions and the only thing that was missing was information about the size of the cameras and how much energy they need that's what they didn't want to tell they wanted to get the information by hand but would have had to demand the fee we didn't know how much that would be so we didn't do that but they were really helpful and gave nice information then another success in the city of Mannheim in the state of Baden-Württemberg finally it's the other way around they gave us the physical dimensions and the power demands just immediately apparently they had it lying around other than that they included a lot of information some details are missing and very interesting was in the city because in the answer to AI they talked about a cooperation with the Fraunhofer Institute that there was a contract they couldn't give us because it's confidential who knows about the request of information laws knows that confidentiality is no reason to keep it back which is why we made a new inquiry including this contract unfortunately that wasn't answered it's not completely done the police department of Mannheim wrote us that they are talking to the data protection officer who is also responsible for this inquiry and they are talking about the details so we have to ask back because that would really be interesting and they promised to get back to us but nothing as of yet so maybe a small overview over the states what we received what kind of information we received so we know that who knows about this inquiry law and freedom of information act that it's a state thing Siberia, Niedersachsen and Sachsen those states don't have this law they don't have a freedom of information act and they didn't really answer and Hassan didn't include the police in their freedom of information act and if they answered they didn't really react so they blocked but Niedersachsen another Saxony maybe they tried so they gave a link to the police department's website and they did include some information or lower Saxony it's called they had some information also some had pictures they had some pictures with all the cameras marked so that was nice and funnily enough we already heard that in the talk of Lilith and Hongkaze sometimes it's difficult with the administration one website was broken and it just threw errors and we don't know what's wrong there what I found that in North Rhine Westphalia we wrote too many but got few responses Cologne blocks entirely Oberhausen answered not at all they answered that there is nothing and otherwise there is not many responses from North Rhine Westphalia so maybe we have to talk to the data protection officer and talk Rheinland-Pfalz, Sachsen-Anhal, Schleswig-Holstein and on the federal level everything is done by the Office of Interior so it makes sense to write them directly and we did get an answer by them also then some special cases that are interesting that we encountered so first the sad stuff with the federal police so they answered that everything in connection with them is classified in principle so we didn't even get things with blackened information and they insisted on this because this was very important to us because they have a lot of surveillance in train stations and the federal data protection officer didn't really help unfortunately he just looked at the laws and said yeah it's classified they want to keep it classified and I found that very sad and in another case a mediation in a similar case was successful so this really made me sad then a curiosity in Heinsberg the police department asked us to provide a copy of our ID after a polite information about the freedom of information act they didn't insist and said yeah we don't do video surveillance that could have been faster and that confused me then in Sachsen-Anhalt they had several departments that sent lists of fees that differed so differing fees and so every one of them had different fees and that really confused us what we were supposed to do with that information the sad thing is that it's quite expensive there as well so that kept us from from really acting so it was up to over 500 euros so it worked as a deterrent with us and Schleswig-Holstein was that so Schleswig-Holstein had one city that has a bit of video surveillance the fees that were quoted were 153.56 euros but they never wanted the money they never asked for it and we say that with the risk of them remembering suddenly but it's still a sign for me that these fees maybe are just used as a deterrent to just block these inquiries yeah, in Goetting in the state of Lower Saxony they are not subject to Freedom of Information Act or they are not bound by it and they sent a 404 in their answer and there was a small mishap in the state of Mecklenburg-Vorpommern everything has to be handed in written or on the phone so they write it down and because I configured it wrongly or the account that we used was configured wrongly it didn't send out faxes yeah it was misconfigured and so we didn't keep the forms correctly that was unhappy so we didn't get much out of them and now we get to what we learned maybe just for you as an information this spring in spring 2021 we started working more intensively on mass requests and a half a year later most of our inquiries were processed so this is a long term project and there's a lot still to do so we have to work on that so it's unfortunate that this draws on for so long it's really a long term project that just takes time and what we also learned is that it's worth it to ask many parties and stakeholders if the police doesn't know ask other authorities and normally there will be one authority who's a little bit more talkative than the others and interprets the law a bit differently even though that also shouldn't be the case and gives out information we had that in cologne for example with the state officer with the state data protection officer we made a deal and she gave us some documents from the police something that's also important get support 195 requests processed by two people or less than five people is difficult to manage regarding time it takes time to read all of the answers and to really understand them so get together find other people who are also interested and that makes it a lot easier something else something else that's also really practical using the frag den staat tool and information freedom tools look around and see what other Germans have already asked and what answers they received because you can also get inspired by other requests that were successful and see how they formulated the requests so you can always learn from others and one of the most important aspects is also posing many requests I get the feeling that the police never got into touch with the information freedom act luckily that has changed continue to change every police office should know what the information act is and what to do with it and that we as citizens deserve answers from the authorities so those are our lessons learned basically from this small project from last year and that was it in our project review thank you very much for this really important talk I'm struggling with my formulations or my wording who is surveilling the surveiller thanks to your commitment I can see that we as a civil society are just passively submitted to this whole thing and about that graphic with 70 versus 130 answers so there's a lot of room for improvement so let's talk there's a lot of questions in the pad wow pick a few of the first ones at the Sudkreuz train station in Berlin they had such a bad recognition rate how did they justify the reported success was there an evaluation report yes there's a report and there's also a blog post on that ccc.de where we analyzed the result of this study a little bit and they basically addressed the results a bit by combining technologies and thank you another interesting number the Federal Police officer forwarding pictures to the Fraunhofer Institute just a very basic question where do these pictures come from well those are pictures from identity checks and I haven't looked into it too much I don't know how long images taken are allowed to be retained because when you have your identity checked by the police you're not automatically considered a perpetrator so they all consented to that right so I'm really respectful of this effort to ask people whether they want to be photographed alright I'll just continue with the next question the police of Hamburg ignore state of protection officer isn't there the option of a restraining order I don't know to the exact state of the case there was a there was the case is still running I think a restraining order wouldn't help or a cease and desist letter because the data don't exist anymore it's still important to retrospectively analyse whether this was legal or not I think this also implies the question because the databases and algorithms may be learned but do we know whether this database really doesn't exist anymore another question was an installation order or combine it with the next question building a database without an installation order can that have consequences and how would they look like will the police be imprisoned now I don't think that there have ever been serious consequences that the police have a database that they shouldn't have other than it being deleted yeah maybe let me add something here will the police go to prison no they won't the police in Germany is a public authority and they are bound by the law so they cannot break the law so this is the thought let down in the basic law we had a similar thing with cameras stop that the federal police didn't comply with court orders and then you can actually file a complaint against that and that will result in the police paying a fee to the court and that was it so not much happening there the list of questions is very long we should still stop here but there will be more questions and answers in the breakout room thank you very much the two of you