A student has confessed to one of Germany’s biggest data breaches, police said on Tuesday, ending the mystery of who hacked Angela Merkel and other public figures, but doing little to ease the embarrassment of cyber security authorities.
Police did not name the 20-year-old but said he lives with his parents and is not a computer expert. Despite that, he managed to access and leak personal data and documents from about 1,000 people, including Chancellor Merkel, other politicians and journalists.
The man was arrested after police searched a property in the central state of Hesse on Sunday evening. Investigators recovered a computer that the suspect had removed two days before the search, and a data backup.
He has been released and is cooperating with investigators.
“During the interrogation, the accused admitted to having acted alone in data spying and the unauthorised publication of data,” the federal crime office BKA said in a statement.
“The investigations have so far provided no indication of the participation of a third party.”
Suspicion had fallen on Russian hackers, blamed for most previous German data breaches, although the Kremlin has denied involvement in such incidents.
There was also speculation that the hack may have involved German far-right activists. Prosecutors declined to comment on any political sympathies the suspect may have but said no radical material had been found.
“The accused said his motivation had been irritation over public statements made by the politicians, journalists and public figures affected,” senior prosecutor Georg Ungefuk said.
Ungefuk told reporters the suspect was repentant and seemed unaware of the full consequences of his actions, adding he had also helped authorities on other matters of interest regarding cyber crime.
The breach has prompted calls for tighter data security laws, especially after the cyber defence agency, BSI, said it was contacted by a lawmaker in early December about suspicious activity on private email and social media.
Sabine Vogt, who heads the federal police division for serious and organised crime, rejected stricter controls, saying it was up to individuals to secure their data.
“We don’t want a surveillance state based on the fact that something like this can happen here,” she told reporters.
However, Konstantin von Notz, a Greens lawmaker who was hacked, described the case as a “final warning shot”:
“As a digital society we must give highest political priority to basic legal protections, improved IT security and strengthening of digital infrastructure.”