Germany’s Federal Network Agency wants to regulate XMPP clients

For context, Bundesnetzagentur (literally “federal network agency”) is a German agency that regulates five kinds of networks – electricity, gas, telecommunications, post, railways. The telecommunications part of their work is supervised by the Bundesministerium für Verkehr und digitale Infrastruktur (literally “federal ministry for transport and digital infrastructure” i.e. highways and data highways).<p>One of its tasks is to ensure non-discriminatory access to infrastructure markets for all market participants: Former state monopolies have to share their infrastructure at a reasonable price to competitors, for example. Another task is consumer protection: In february 2017 they decided that an internet-enabled child&#x27;s doll containing a microphone accessible remotely without any indication to the people using that doll should be “verboten” since they classified it as a hidden wiretapping device.<p>The federal network agency claims that XMPP clients have to be registered according to a German law that says that one has to be registered with (but does not need permission from) the agency if providing public communication services commercially.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Federal_Network_Agency" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Federal_Network_Agency</a><p>Edit: As other hackernews have pointed out, only the telecommunications stuff is supervised by the BMVI.

Original (in German): <a href="https:&#x2F;&#x2F;www.golem.de&#x2F;news&#x2F;meldepflicht-bundesnetzagentur-will-hundert-jabber-clients-regulieren-1703-126929.html" rel="nofollow">https:&#x2F;&#x2F;www.golem.de&#x2F;news&#x2F;meldepflicht-bundesnetzagentur-wil...</a><p>TL;DR German Federal Network Agency (BNetzA) contacted more than 100 developers of XMPP clients, in or outside Germany. BNetzA considers XMPP-clients to be &quot;telecommunication services&quot; and requested developers to register with German authorities, as required by the German &quot;telecommunication law&quot;.<p>Here&#x27;s a relavant tweet by Xabber developer from Chelyabinsk, Russia:<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;Xabber_XMPP&#x2F;status&#x2F;844865634672435200" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;Xabber_XMPP&#x2F;status&#x2F;844865634672435200</a><p>Update: Corrected BND -&gt; BNetzA, was a wrong translation.

The interesting bit is that they explicitly point out part 7 of the TKG (telecommunications act) which details the telecommunication provider&#x27;s duties in assisting law enforcement agencies, such as providing interfaces for targeted surveillance.<p>Relevant part of the law:<p><a href="https:&#x2F;&#x2F;translate.googleusercontent.com&#x2F;translate_c?depth=1&amp;hl=de&amp;ie=UTF8&amp;nv=1&amp;prev=_t&amp;rurl=translate.google.com&amp;sl=de&amp;sp=nmt4&amp;tl=en&amp;u=https:&#x2F;&#x2F;www.gesetze-im-internet.de&#x2F;tkg_2004&#x2F;BJNR119000004.html&amp;usg=ALkJrhizUtlFGCANtatJPtuf8nRlx4hPlg#BJNR119000004BJNG001800000" rel="nofollow">https:&#x2F;&#x2F;translate.googleusercontent.com&#x2F;translate_c?depth=1&amp;...</a><p>See especially paragraph 110 and following.<p>So I wonder if they want developers of XMPP software to implement surveillance features?

Here&#x27;s the page the Xabber guys were referred to: <a href="https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;EN&#x2F;Areas&#x2F;Telecommunications&#x2F;Companies&#x2F;Notification&#x2F;NotificationRequirement-node.html" rel="nofollow">https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;EN&#x2F;Areas&#x2F;Telecommunications...</a><p>It&#x27;s in English, but the registration form is in German: <a href="https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;SharedDocs&#x2F;Downloads&#x2F;DE&#x2F;Sachgebiete&#x2F;Telekommunikation&#x2F;Unternehmen_Institutionen&#x2F;Anbieterpflichten&#x2F;Meldepflicht&#x2F;Meldeformular_pdf.pdf;jsessionid=F0427467E2779E03415AF0AB9CD01C6D?__blob=publicationFile&amp;v=13" rel="nofollow">https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;SharedDocs&#x2F;Downloads&#x2F;DE&#x2F;Sac...</a><p>Here&#x27;s a cursory overview (IANAL!): They want the name of your company, and for companies outside Germany, the name of a representative in Germany; and a way to contact you. Page 2 concerns access providers, e.g. ISPs. Page 3 concerns service providers, with provisions for all manner of services from VoIP, Email, messaging, VPNs and more general network solutions, and a field for &quot;other&quot; (&quot;include brochure where applicable&quot;). They close with some explanations, and a threat of fines up to 10000 EUR in case of non-cooperation.<p>Fun stuff.<p>The list of companies that have complied is public: <a href="https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;SharedDocs&#x2F;Downloads&#x2F;DE&#x2F;Sachgebiete&#x2F;Telekommunikation&#x2F;Unternehmen_Institutionen&#x2F;Anbieterpflichten&#x2F;Meldepflicht&#x2F;TKDiensteanbieterPDF.pdf;jsessionid=F0427467E2779E03415AF0AB9CD01C6D?__blob=publicationFile&amp;v=62" rel="nofollow">https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;SharedDocs&#x2F;Downloads&#x2F;DE&#x2F;Sac...</a><p>It&#x27;s 149 pages at around 20 entries per page (there&#x27;s also an Excel version available). Facebook is not listed. Google is, hilariously with the note that there is an ongoing legal dispute on whether they are required to register.

I find this bit of their reasoning particularly curious:<p>&gt; <i>The authority argues that the software would also take over functions of a server in so-called Over The Top services (OTT services) and thus not to be assessed as pure software.</i><p>If I&#x27;m not misunderstanding that, the agency asserts that a software requires regulation because it <i>opens a port for listening</i>.<p>On the risk of being alarmist, my suspicion for some time is that the next step in centralising the internet will involve stronger legal hurdles for usage of the internet that does not conform to the standard &quot;dumb client+cloud backend&quot; pattern. I fear this is the beginning of exactly that.

The translation is wrong, it is the Federal Network Agency. Comparable with the FCC in the US but it also regulates other network based markets. But they have nothing to do with the BND.<p>See <a href="https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.bundesnetzagentur.de&#x2F;</a>

Isn&#x27;t it a bit too late?<p>XMPP was big-ish ten years ago, maybe. Today even Google discontinues its client.

Germany also wants you to pay for a broadcasting license (costs up to $10,000) if you continuously livestream online, regardless of whether you are making any money from livestreaming.<p>All of this reeks of ham-fisted overregulation.

Regulating a specific application layer protocol is like regulating to speak English in the phone call.<p>The result: We&#x27;ll use yet another protocols and natural languages.

Lost in translation: Not the BND (German Federal Intelligence Service) wants to regulate it, rather it is the Bundesnetzagentur (think FCC).