Does the "German Hacking law" deny the opportunity to do private penetration testing?

Question

Would the possession of a Rubberducky Stick or an Pineapple router get you in trouble (even if you don't have evil intentions) with the new German anti-hacking law?

Answer 1

The German criminal code section 202c (Acts preparatory to data espionage and phishing) paragraph 1 reads:

(1) Whosoever prepares the commission of an offence under section 202a or section 202b by producing, acquiring for himself or another, selling, supplying to another, disseminating or making otherwise accessible

1. passwords or other security codes enabling access to data (section 202a(2)), or

2. software for the purpose of the commission of such an offence,

shall be liable to imprisonment not exceeding one year or a fine.

As a legal layman I would interpret this as saying that owning "hacking software" is only illegal when done with the intention of violating the sections 202a (data espionage) or 202b (phishing) which both deal with unlawful obtaining or intercepting of data.

That was also the estimation of a prosecutor in Fulda. In 2008, the CEO of an IT consulting company indicted himself, because his company frequently uses such tools for penetration tests on their customer's systems. The prosecution refused to prosecute because they considered it obvious that there was no intention to use these tools in an unlawful manner (source: German Wikipedia citing a court case reference number which doesn't seem to be available online).

So when you only intend to use them to test your own system, it should not be illegal.

But keep in mind that not breaking any laws does not protect you from "trouble" in form of getting indicted or prosecuted. It only protects your from getting convicted, if you have a good lawyer.