Spying affair in the Federal Ministry of Health: Sentences reduced by the Federal Court of Justice.

Email Inboxes of High-Ranking Ministry Officials Hacked

IT administrator Christoph H., who worked externally for the IT industry giant Bechtle at the Federal Ministry of Health, was accused of deliberately spying on the email accounts of high-ranking ministry officials on behalf of pharmaceutical lobbyist Thomas Bellartz and subsequently selling the information to him. According to information from the *Süddeutsche Zeitung*, the monitored email accounts included those of former Health Ministers Philipp Rösler and Daniel Bahr. The focus was particularly on drafts and developments in legislative proceedings relevant to the industry. The system administrator is said to have received 26,550 euros from the lobbyist for the information obtained in this manner. The latter is no stranger to the industry; as the former editor-in-chief of the *Pharmazeutische Zeitung*, former press spokesperson for the Federal Association of German Pharmacy Associations, and, among other things, operator of his own industry service *Adhoc*, he is extremely well-connected.

Suspicions of a data leak arose, among other things, when information regarding work on the amendment to the Pharmacy Operating Regulations—which had been classified as confidential—became public. Daniel Bahr, then acting Federal Minister of Health, filed a criminal complaint. As reported by the Tagesspiegel, Christoph H.’s ex-wife is said to have provided an anonymous tip. Investigators discovered that one of the defendants had withdrawn amounts—mostly in the three-digit range—from his account, which were deposited shortly thereafter into the bank account of the other defendant. On November 20, 2012, investigators from Precinct 335 (“Cybercrime”) searched Office 262 at the Federal Ministry of Health. Christoph H., who was present there, was led away in handcuffs. At the same time, officers searched the premises at his home address and ultimately seized four computers, three cell phones, eleven hard drives, 232 DVDs, storage media, and envelopes containing 15,000 euros in cash.

The proceedings at the Berlin Regional Court

Although the original proceedings at the Berlin Regional Court had previously involved investigations into multiple cases, following a partial dismissal pursuant to § 154(2) of the Code of Criminal Procedure, only two cases (Case 28 and Case 40) from 2012 formed the basis for the conviction. In these cases, the court in the original proceedings (Berlin Regional Court, April 10, 2019, Case No.: 222 Js 1953/12 (501 -) (39/13)) that the two defendants had spied on data from the Federal Ministry of Health with the intent of gaining an informational advantage regarding developments in health policy. According to the court’s finding, they followed a joint plan to commit the crime.

As part of this, Christoph H., acting as a system administrator for Bechtle—an external IT service provider working for the ministry—had, since 2009, exploited systemic security vulnerabilities to unlawfullygained unauthorized access to the personal email accounts of high-ranking ministry employees, includingthe Federal Minister of Health and his state secretaries, and extracted the files stored therein (e.g., drafts of laws and regulations). He then sold the copied data to Thomas Bellartz, who subsequently published it on Adhoc, the online industry portal he operates. Pursuant to§ 202a of the German Criminal Code (StGB), the Regional Court classified the spying on the email accounts as a joint offense and, furthermore, pursuant to§ 202a(1) StGB, the defendants were found to have circumvented the security measures protecting access.

In determining the severity of the penalties, the delay in the proceedings and the inadequate data protection measuresat the ministry were taken into account as mitigating factors, while the scope of the offenses was considered an aggravating factor: The data obtained included, among other things, information on  an amendment to the Pharmacy Operating Regulations, a draft of the Pharmaceutical Reform Act, the results of negotiations regarding reimbursement rates for certain medications, fee negotiations with the National Association of Statutory Health Insurance Physicians and the statutory health insurance carriers, and the introduction of a flat-rate reimbursement for night and emergency pharmacy services.

The Regional Court imposed a fine on Thomas Bellartz in the amount of 300 daily rates at 220€ each (total of 66,000 €), with 60 daily rates deemed to have already been served, effectively reducing the fine to 52,800€. The court sentenced Christoph H., who was also convicted of a residential burglary and possession of child pornography, to one year and eleven months in prison, which was suspended on probation. For Christoph H. as well, part of the sentence (five months) was considered to have already been served. In the decision regarding the forfeiture of assets pertaining to Christoph H., pursuant to § 154(2) of the Code of Criminal Procedure, his income from the resale of the intercepted data was also taken into account. Both defendants filed appeals against the judgment.

Decision of the Federal Court of Justice (BGH)

On May 13, 2020, the Federal Court of Justice (BGH) ruled on the matter (BGH Decision - 5 StR 614/19) and thereby reduced the sentence imposed by the Berlin Regional Court in the case of H. The conviction against Bellartz in its previous form was overturned.

In this regard, H.’s appeal was successful with respect to the amount of the fine, but not with respect to the finding of guilt. The BGH emphasized that his conviction for espionage in two instances is supported by the findings made during the proceedings, which were free of legal error. Christoph H. was found guilty under § 202a(1) StGB and § 202a(2) StGB by deliberately circumventing security measures in order to gain unauthorized access to third-party data and to make copies of it. Notably, the Federal Court of Justice (BGH) states that the criminal liability for this act is not altered by the fact that the security measures in question were easy for Christoph H. to circumvent.

The partial success of Christoph H.’s appeal thus stems entirely from the fact that the Berlin Regional Court, in setting the amount of the fine, took into account not only the circumstances of the two offenses deemed proven, but also those of a portion of the dismissed charges.of the two offenses deemed proven but also those of some of the dismissed offenses. The Federal Court of Justice (BGH) pointed out that this was not permissible and therefore, when adjusting the fine for Christoph H., deducted the resulting amount from the total fine. As the Federal Court of Justice explicitly emphasized, the penalty was otherwise calculated correctly, so the appeal is also unfounded.

In the Bellartz case, however, the BGH ruled that his status as an accomplice did not withstand review by the appellate court. This was because he had no influence on—and could not have had any influence on—the actual commission of the crime (spying and intercepting data by bypassing access security measures). Even though Bellartz had an interest in the success of the crime, he had no knowledge of how Christoph H. had gained access to the data. The Federal Court of Justice (BGH) had therefore considered changing Bellartz’s conviction from complicity to incitement to spy on data. However, the Senate felt precluded from doing so, as Bellartz might have been able to defend himself more successfully against such a charge.

Beyond this error in assessment, however, the findings remain unaffected, so Bellartz’s appeal is unsuccessful. Based on the error in legal assessment, the case was remanded to the Regional Court for a new decision.

Sources