The Bundesnachrichtendienst, or BND, gets to freely sift through all the foreign traffic passing through that exchange junction in search of nuggets that can be shared with overseas partners such as the NSA. But now that power is in jeopardy, thanks to a Tuesday ruling from Germany’s constitutional court.

The case was brought about by journalists who report on human rights in conflict zones. They don’t want German spies potentially identifying their sources there and sharing that information with other countries.

Germany’s Federal Constitutional Court ruled that foreigners also benefit from privacy protections under Germany’s constitution, so the surveillance conducted on them by Germany’s spy agency needs to respect their rights.

The legislation in question, which was introduced in 2016, does nothing of the sort. Indeed, those rules trample over foreigners’ rights in a variety of ways, the court said: They allow mass surveillance rather than targeted surveillance; there’s not enough oversight of the spying; there are no protections for journalists and lawyers, as there should be; and there aren’t enough restrictions or safeguards when it comes to sharing the information with the likes of the NSA.

The court said it was possible to have a constitution-compliant law governing the surveillance of foreigners in other countries, so the German government has until the end of 2021 to make the necessary adjustments.

The Frankfurt connection

Germany’s signals intelligence agency—the Bundesnachrichtendienst, or BND—has had an information-sharing deal with the NSA since soon after 9/11. After NSA contractor Edward Snowden in 2013 spilled the beans about the American agency’s international partnerships, it emerged that the NSA had been directing the BND to gather information on high-profile targets such as the European Aeronautic Defence and Space Company, and the administrations of France and Austria.

This triggered a parliamentary inquiry in Berlin, which revealed a lot about the BND’s tapping of the data flowing through the DE-CIX Internet exchange point in Frankfurt (the world’s second-largest Internet exchange point, after the Brazil Internet Exchange). DE-CIX’s operators complained that the BND was supposed to monitor only a fifth of the traffic passing through but was actually scooping up the whole lot.

The solution introduced in the 2016 law was to simply legalize what the BND had been quietly doing before—it lifted the 20% limitation and allowed the BND to access all it wanted. The law also explicitly allowed the agency to spy on journalists’ communications.

In its Tuesday ruling, the constitutional court said none of this was kosher, because the German government was wrong to assume that foreigners outside its territory don’t fall under Germany’s constitutional privacy protections.

“With its decision, the Federal Constitutional Court has clarified for the first time that the protection afforded by fundamental rights vis-à-vis German state authority is not restricted to the German territory,” the court said in a statement.

The BND said in a statement that it would evaluate the judgment and help the government to adapt its law so as to protect both fundamental rights and Germany’s security. “Nobody has a greater interest in acting on legally secure grounds than the BND itself,” said the agency’s president, Bruno Kahl.

Journalists rejoice

The German chapter of Reporters Without Borders, which brought the case in partnership with the Berlin-based Society for Civil Rights (GFF) and a few other journalists’ associations, is overjoyed.

“The Federal Constitutional Court has once again underlined the importance of freedom of the press,” said Reporter Without Borders chief Christian Mihr in a statement. “We are pleased that [the court] is putting a stop to the escalating surveillance practices of the BND abroad.”

GFF lawyer Bijan Moini said the German government would now finally have to rein in the practices that Snowden had exposed.

The whistleblower testified in 2014 that the NSA had set up what was effectively a “bazaar” of Internet espionage among European spy agencies, all of which would spy on people outside their own borders in order to comply with their domestic restrictions, then share the information with the Americans.

This story has been updated to include a statement from Bruno Kahl, BND president.