Can high-tech toys turn your child into James Bond? - The Federal Network Agency takes steps against "Spy Devices"

Almost one year ago, the Federal Network Agency (Bundesnetzagentur or BNetzA) asked parents to destroy the interactive doll "Cayla" after this smart toy was deemed a spy device, or legally speaking, a transmitter whose possession, manufacture, distribution, and import is prohibited pursuant to § 90 Telecommunications Act (TA). (See our Blog, dated 27 February 2017).

Recently, BNetzA attracted further attention in the tech industry by defining child smart watches as prohibited transmitters under § 90 TA, and banning their sale and possession in Germany.

Given that more and more smart-and-interactive-technology products are being placed on the market with microphones and/or cameras (eg voice-controlled smart home products, and smart watches), the BNetzA decisions received wide attention. BBC News Online called the rulings “a 'game-changer' for internet-connected devices on the German market."

The § 90 act is in fact a sharp sword, which if drawn against a device can lead to a ban on its manufacture, distribution, import, and possession in Germany. Banned devices already on the market must be removed from shelves and destroyed.

Violators face a fine of up to EUR 25,000 and criminal charges carrying a penalty of up to two years in prison (see § 148 para. 1 nr. 2 TA).

Since § 90 TA prohibits the possession of banned devices, parents who purchased these toys for their children face penalties if they do not comply. In addition, simply advertising banned devices can lead to a fine of up to EUR 100,000 or more if the financial benefit gained from advertising exceeds this amount (§ 149 para. 1 nr. 15, para. 2 sentence 1 nr. 3 and sentence 2 TA).

To help manufacturers avoid liability (and children avoid the disappointment of having toys taken away), it is important to clarify the requirements a device with a microphone and/or a camera must fulfill to avoid the § 90 TA ban.

A look at the legislation is helpful: § 90 para. 1 TA prohibits the manufacture, distribution, import and possession of transmitters:

which by their form pretend to be a different object or are disguised with items of daily use and on the basis of these circumstances or on the basis of their mode of operation are in a special manner suited and intended for listening in on the publicly spoken speech of another person without their noticing or recording the image of another person without their noticing.

In sum, for a device to be banned under § 90 TA it must: 1) be a transmitter 2) pretend to be a different object or disguised as an item of daily use, and 3) be able to make sound and image recordings of people without their knowledge.

Further application of the rule

Given this definition, § 90 TA applies to a broad area of products, covering all commonly used digital items with a microphone or camera, such as mobile phones, smart TVs, smart watches, smart home assistants, laptops, tablets, and even connected toys with a microphone and/or camera. An Internet connection is not necessarily a violation, but a Bluetooth connection with a mobile phone may be.

Unnoticed sound or image recordings

In order to prevent overreach, a 2012 amendment to the Telecommunications Act added a provision to § 90 para. 1 sentence 1 TA that the legislation shall only apply to devices:

which from the outset do not serve any recognisable purpose, but rather apparently only serve the purpose of secret listening in on discussions or the secret making of picture recordings of another person. Devices which on the basis of their mode of operation are also suited for unnoticed listening in on others or unnoticed picture recording, but do not have this as their designated purpose, such as mobile phones, should not fall under the ban. (My emphasis)

In sum, legislators intended that § 90 TA only ban devices if their sole purpose is to secretly listen to discussions or make visual recordings of another person.

BNetzA does not follow this narrow view. As indicated by its statements on its Information Page, it interprets § 90 TA based on teleological considerations. Where the amendment tries to protect privacy by preventing clandestine remote monitoring, for BNetzA the mere possibility a device may be used for secret sound and image recordings is sufficient reason to enforce § 90 TA.

In the case of the Cayla doll, security flaws with the doll’s Bluetooth connection made it possible for third parties to listen in on discussions using their mobile phones. Because an app could be used to deactivate the recording signal-light on the doll, someone in close proximity to it would not know that he was being recorded.

In the more recent smart-watch ban, BNetzA noted that the watch’s app had a function specifically designed for listening, and that the watch could be connected to a phone without the knowledge of the user. According to a BNetzA investigation, parents had already used this function to listen in on and monitor their children during classes.

Take note

To avoid conflict with § 90 TA, a device must not be able to make an audio or visual recoding of a user or bystanders without their knowledge.

To help manufacturers and customers achieve further clarity on this, BNetzA has posted definitions and notes on its web Information Page that divide applicable products into categories: smart watches, voice-controlled assistant systems, drones, GSM trackers, high-tech toy cars, and security cameras with information transmission capabilities. (Note that this list is not definitive, but simply reflects the current focus of the Federal Network Agency.) The following BNetzA table offers summaries of these product categories:

If manufacturers and purchasers pay special attention to these notes, the risk is low that toys will be transformed into spy devices and innocent children into spies … even if kids want to be James Bond when they grow up.