§ 202c StGB
Section 202c German Criminal Code — Acts Preparatory to Data Espionage
§ 202c StGB — Vorbereiten des Ausspähens und Abfangens von Daten
Section 202c of the German Criminal Code — the so-called „hacker paragraph“ — already criminalises preparatory acts: the production, procurement, sale or distribution of passwords, security codes or of programs whose purpose is the commission of an offence under Section 202a or 202b. Thus the mere provision of the means is punishable. The norm was and is controversial because of its broad wording.
History & facts. With the 41st Criminal Law Amendment Act (in force 2007), the legislator moved punishability forward to preparation — such as the distribution of hacker tools. The penalty range extends up to two years' imprisonment or a fine. The „dual-use“ problem was fiercely debated: many tools of security research (scanners, exploit frameworks) can be used both for protection and for attack. Decisive, according to the prevailing interpretation, are the purpose-determination of the program and the intent to prepare an offence under Section 202a/202b.
Outlook & recommendation. For legitimate security work the delimitation is central: tools used within the scope of commissioned, authorised tests do not serve the preparation of an offence. Those who conduct pentests or research should document the assignment, the consent and the purpose and use tools in a controlled manner. The ongoing debate shows how narrow the ridge between protection and punishability is formulated. This is not legal advice; in individual cases legal counsel should be sought.