Technical Articles and White Papers

Data-Minimal Age Verification—Technical Methods and Legal Classification

Prof. Dr. Martin Steinebach, Julian Hunter, York Yannikos

DuD 4/26

Verifying a person’s age online can serve various purposes. Ensuring legally compliant access to age-restricted content is a primary concern, but protected communication spaces for minors are also an important example. Numerous methods for assigning an age to a person are known. The authors examine and categorize these methods and discuss their legal context. 

Read the article (german only)

Regulation of Data Protection, Data Use, and Cybersecurity

Dr. Michael Kreutzer, Dr. Dr. Annika Selzer, Sarah Stummer

DuD 4/26

Data protection, data use, and cybersecurity are cornerstones of our society’s protection. However, the regulation of these three areas is creating a growing tangle of legal provisions that could undermine the intended protection and weaken Europe as a hub for innovation. 

Read the article(german only)

Between Regulatory Requirements and Practical Feasibility: Startups Caught Between the Cyber Resilience Act and the AI Act

Maxine Joanne Folschweiller

In recent years, the European Union has significantly tightened its regulation of digital technologies. These developments are part of the EU’s digital policy, which aims to combine innovation, security, and the protection of fundamental rights while simultaneously strengthening Europe’s digital sovereignty and competitiveness.

As key drivers of digital innovation, startups play a pivotal role, particularly in areas such as artificial intelligence, software, connected products, and cybersecurity. At the same time, they face particular challenges: European regulatory frameworks are largely designed to be neutral with respect to company size and thus disproportionately affect young companies with limited resources. This creates a structural asymmetry between regulatory requirements and practical feasibility.

Against this backdrop, this paper examines how young technology companies are dealing with the requirements of the Cyber Resilience Act (CRA) and the AI Act, and to what extent these requirements promote or hinder innovation under startup conditions.

Read the article (german only)

On the Criminal Liability of Accessing Password-Protected Images: A Simulation Study for Greater Legal Certainty in Cybersecurity Research

Jessica Kriegel, Jubin Dejam, Hanno Durth, Florian Franke, Wolfram Hemkens, Sebastian Rothweiler

DuD 12/25

Cybersecurity law in Germany has undergone several modernizations in recent years, but it still does not provide cybersecurity researchers with clear guidelines for action. Researchers face significant legal uncertainties, which restrict their work. Against this backdrop, the National Research Center for Applied Cybersecurity ATHENE is conducting a multi-year simulation study to develop more guidelines for ensuring the legal compliance of research activities.

Read the article (german only)

Cybersecurity Training

Markus Schneider, Elias Heftrig, Sinisa Dukanovic, Thomas Dexheimer

DuD 11/25

Given the current threat landscape and increasing risks, it is not only technical protective measures that matter, but also the knowledge and skills acquired by those involved in cybersecurity. However, cybersecurity knowledge is evolving rapidly and can quickly become outdated. To keep pace and meet requirements, continuous professional development is essential. Lack of knowledge and incorrect actions can have serious consequences. Yet different tasks require different skills.

Read the article (german only)

The Use of AI-Generated Data Protection Training Materials: Perspectives from Data Protection Law and Business Administration

Dr. Annika Selzer, Dr. Jan Ole Berndt, Prof. Dr. Ingo J. Timm

DuD 8/2025

Companies are required to train their employees on data protection law. This obligation can be particularly challenging for small businesses without a data protection officer, leading some companies to rely on AI-generated training materials. This article examines the data protection quality and the business advantages of such training materials.

Read the article (german only)

Cybersecurity in the Energy Sector -- Challenges in the Practical Implementation of the Proposed Section 5c of the Energy Industry Act

Dominik Appelt, Matthias Enzmann, Annika Selzer

DuD 6/2025

The energy sector is an attractive target for cybercriminals, and successful attacks can, among other things, severely restrict access to critical communication channels. Against this backdrop, it is essential to protect the energy sector as effectively as possible against cyberattacks. The provisions of the NIS 2 Directive and its planned national implementation provide regulatory support for this goal. But what challenges do NIS 2 and its planned national implementation pose for Germany’s energy suppliers?

Read the article (german only)

Online Age Verification to Ensure the Protection of Minors

Thomas Kunz, Ulrich Waldmann

DuD 6/2025

Reliable age verification is required for the use of social media services, but is often implemented inadequately. This can result in minors using services that are inappropriate for their age. This article examines current age verification practices and evaluates various methods in terms of their suitability. In contrast, the use of digital identities such as Self-Sovereign Identity (SSI) is considered a promising future solution, supported by eIDAS 2 in the form of electronic attribute certificates from the European Digital Identity Wallet (EUDI Wallet) and offers a data-minimal alternative to traditional age declarations.

Read the article (german only)

Privacy-Preserving Age Verification

York Yannikos, Martin Steinebach

BZKJ Aktuell 2/2025

The authors present a method for secure and data-sparse age verification. In this self-developed approach, the specific age is not verified. Instead, individuals can confirm or have verified that they belong to a certain age group without transmitting any further personal data to the service.

Read the article (german only)

The Metaverse—A Privacy Trap?

Marina Steenbergen

DuD 5/2025

Metaverse applications could become part of our everyday lives in the future. At the same time, academic literature and organizations are already pointing out that the use of immersive virtual worlds also entails data protection risks. Motivated by the results of an empirical data collection study on general interest in the use of such applications as well as factors inhibiting their use, this article analyzes three risks associated with metaverse use based on risk factors under the GDPR.

Read the article (german only)

Risks for Residential Charging Infrastructure

Daniel Zelle, Dirk Scheuermann, Jonathan Stancke

The overall system of controlled, bidirectional charging is a complex infrastructure comprising numerous entities and communication channels. Each of these components is potentially vulnerable to attacks. The white paper explains that different risks exist depending on the required security properties and the components’ position within the architecture.

Read the article (german only)

Active Cyber Defense

Prof. Dr. Michael Waidner, Prof. Dr. Haya Shulman

We define active cyber defense as a range of technologies and measures that can assist law enforcement agencies in preventing, mitigating, or prosecuting cybercrimes.

Active cyber defense is often equated in the public sphere with “hackbacks.” However, a hackback refers to a digital retaliatory attack against the cyberattacker—that is, a measure intended as revenge, not as a means of prosecuting or thwarting criminal offenses. Hackbacks are therefore almost unanimously rejected by policymakers and academics. Unfortunately, the mistaken conflation of active cyber defense and hackbacks leads to active cyber defense itself often being rejected across the board. One goal of this white paper is therefore to contribute to a more objective discussion of active cyber defense.

Read the article (german only)

No cybersecurity without data protection, no data protection without cybersecurity?

Alina Boll

DuD 6/2023

Restoring Cybersecurity Through Active Defense Against Cyberattacks—The protection of personal data requires secure data processing. Data security is therefore an integral part of—and even a prerequisite for—effective data protection. However, cybersecurity measures must also comply with the data protection requirements of the GDPR, provided that personal data is processed within that framework. This article explains whether and how data protection must be implemented when IT security research institutions carry out a cybersecurity measure, using the defense against a BGP hijacking attack as an example.

Read the article (german only)

Digitalization in Germany: A Comparison with South Korea and Singapore

Stefan Engelbrecht, Jens Gerber, Michael Gyollai, Philipp Rosch, Cord C. Schulz, Annika Selzer

DuD 6/2023

In February 2023, executives from government, industry, and applied research participated in a field study examining digitalization in Germany. The findings regarding the state of digitalization in Germany were compared with the efforts of South Korea and Singapore in this area. This article aims to compile key findings from the field study and thereby contribute to the political and societal discussion.

Read the article (german only)

Personal Information vs. Anonymity

Sarah Stummer

DuD 6/2023

A mapping of the legal and technical understanding of the terms “personal data,” “pseudonymity,” and “anonymity”: To make anonymization practically applicable and to be able to set concrete requirements for anonymity, this complex of topics should be examined from an interdisciplinary perspective. This requires starting with the fundamental concepts of personal data and anonymity and standardizing them across disciplines.

Read the article (german only)

Metric Systems as a Contribution to Implementing the Risk-Based Approach

Tanya Gärtner, Annika Selzer

DuD 6/2023

The risk-based approach is a defining feature of the GDPR. The proper and precise implementation of this principle is expected to yield efficiency gains for data controllers without compromising an adequate level of protection for data subjects. This article examines whether there is potential for optimization in this regard with respect to data protection audits and to what extent new technologies can be utilized for this purpose. To this end, the data protection audit process is analyzed and examined for the applicability of data protection metrics.

Read the article (german only)

Has the frequent use of video calls during the COVID-19 pandemic affected our understanding of privacy?

Dr. Annika Selzer, Sarah Stummer

DuD 12/2022

Since the start of the COVID-19 pandemic, people have often been able to communicate with business partners, friends, and family members only virtually. For most people, video calls were the method of choice for making these interactions as personal as possible. Based on twenty semi-structured interviews, this article examines the extent to which video calls—and the associated feeling of “being watched” by a camera—have influenced our understanding of privacy.

Read the article (german only)

White Paper "Comparison of Charging Infrastructure Architecture Designs for Calibration-Compliant, Authenticated Charging Processes Incorporating an SMGW"

Daniel Zelle, Maria Zhdanova, Christoph Krauß et al.

In the LamA-connect research project, the project partners are addressing the question of how the rapidly growing electric mobility sector can be meaningfully integrated into the power grid. With a focus on options for the secure and intelligent control of charging infrastructure while ensuring metrology-compliant billing of charging processes, this paper compares and evaluates three different architectures for integrating Smart Meter Gateways (SMGWs) into charging infrastructure.

Read the white paper (german only)

Data Protection-Compliant Deletion in the Event of Data Protection and Information Security Incidents

Louisa Rudolph, Dr. Annika Selzer, Dr. Ulrich Pordesch

BvD News 2/2021

This article discusses when personal data generated in the course of documenting data protection and security incidents must be deleted in accordance with the requirements of the GDPR, and how a deletion rule for incident documentation can be formulated for a catalog of deletion rules.

Read the article (german only)

White Paper "IT/OT Security in the Internet of Railway Things"

Publisher: AG CYSIS

Today, sensors have become indispensable in railway applications. They continuously collect data to optimize traffic, manage passenger flow, and improve energy and maintenance efficiency. On the one hand, this supports high levels of availability and safety; on the other hand, the resulting analyses effectively promote increased transportation performance. However, the widespread use of sensors and their interconnection as the Internet of Railway Things (IoRT) also give rise to new attack vectors that must be addressed efficiently while complying with standards, laws, and regulations in the railway sector.

The white paper “IT/OT Security in the Internet of Railway Things (IoRT)” explains applications of IoRT devices and possible IT security strategies that simultaneously take into account data usage, device operation, and adaptability to IT security requirements. The white paper was developed as part of the Cybersecurity Working Group (AG CYSIS), an innovation alliance between TU Darmstadt and DB Netz AG.

The white paper was developed in collaboration with the partners Fraunhofer SIT, Cisco, ÖBB, and INCYDE as part of the “Haselnuss” project—IT Security for Railways.

To the White Paper

English Version of the White Paper

Deleting Personal Data in Customer Relationship Management Systems in Compliance with Data Protection Regulations

Tugba Koc Macit, Annika Selzer

BvD-News, Issue 1/2020

The GDPR mandates the deletion of personal data once the purpose for which the data was collected no longer applies. This article describes approaches for implementing this deletion requirement in customer relationship management (CRM) systems.

Read the article  (german only)

The Use of Computer-Generated Child Pornography for Investigative Purposes on the Dark Web

Sandra Wittmer, Martin Steinebach

In: David, K., Geihs, K., Lange, M., & Stumme, G. (Eds.), INFORMATIK 2019: 50 Years of the German Informatics Society – Informatics for Society. Bonn: German Informatics Society (GI). (pp. 381–392). DOI: 10.18420/inf2019_56

The opportunities for cybercriminals to commit crimes largely anonymously using the Internet are constantly growing with the development of new technologies. A well-known example of this is the distribution of child pornography via secure peer-to-peer networks such as Tor and Freenet. Since the details surrounding the shooting spree outside the Olympia shopping center in Munich came to light, the dark web has entered the public consciousness as a synonym for such networks. Most recently, during the 89th Conference of State Ministers of Justice, it was even proposed that computer-generated child pornography be permitted on the dark web for the purpose of identifying perpetrators. The following article addresses the resolution passed by the Conference of State Ministers of Justice and examines the current debate by discussing the legal framework and technical possibilities for implementing such a project.

Read the article (german only)

Deletion Under the GDPR—A Discussion of Data Protection-Compliant Implementation for Emails

Erdem Durmus, Annika Selzer, Dr. Ulrich Pordesch

DuD, Issue 12, 2019

The GDPR requires data controllers to delete personal data once the purpose of its processing has been fulfilled. This obligation to delete data is often counterbalanced by numerous (special) statutory retention requirements. In business practice, email is one of the most important means of communication; however, the targeted evaluation and deletion of thousands of emails presents a complex challenge. This article discusses various possible solutions for overcoming this challenge.

Read the article (german only)

Encryption in the Cloud

Michael Herfert, Benjamin Lange, Dominik Spychalski

Digma, Issue 3/2019

Encryption is a natural choice as a security measure for cloud services. But what exactly does “encryption” mean? What level of protection do the various encryption solutions provide? How effective are new approaches such as hardware-based secure execution environments or homomorphic encryption? And what about long-term encryption?

Read the article (german only)

The Future of Data Processing Controls—Changes and Opportunities Brought About by the GDPR

Annika Selzer

This article discusses data processing controls under the Federal Data Protection Act and data processing controls under the General Data Protection Regulation, and concludes with a proposal for automated data protection controls as a future model for data processing controls. 

DuD Issue 4, 2017

Read the article (german only)

Data Protection and Data Analysis

By Martin Steinebach, Erik Krempel, Christian Jung, and Mario Hoffmann

DuD, Issue 7, 2016

One of the major opportunities presented by big data is the new insights gained through the rapid and flexible analysis of large volumes of data. However, to conduct this analysis in compliance with the law, data protection must be observed as soon as personal data is accessed. Various approaches and concepts now exist for combining data protection and data analysis.

Read the article (german only)

Semi-Automated Verification of Separate Processing in the Cloud

By Bernd Jäger, Reiner Kraft, Annika Selzer, and Ulrich Waldmann

DuD, Issue 5, 2016

Data protection in cloud environments that can be automatically measured and evaluated can alleviate data protection concerns for potential cloud users. However, for each measurement, suitable data sources must first be identified and meaningfully combined in order to approach automated verification of data protection objectives. This article proposes such an approach for the data protection objective of separate processing.

Read the article (german only)

Monitoring the Degree of Implementation of Access and Access Protection

By Bernd Jäger, Reiner Kraft, Annika Selzer, and Ulrich Waldmann

DuD, Issue 4, 2016

Widespread data protection concerns regarding cloud services are hindering their use. This article examines how automated data protection controls—which show users the degree to which data protection goals have been implemented—can help overcome this barrier.

Read the article (german only)

The Crucial Question: How Do You Feel About App Security?

By Jens Heider

DuD, Issue 1, 2014

With smartphones and tablets becoming increasingly integrated into everyday work life, the security of corporate data is no longer based solely on protection at the network and endpoint levels. Ensuring the reliability and security quality of the flood of apps to meet corporate requirements also demands a critical approach to the software. Using the results of large-scale app tests, this article highlights examples of this challenge and discusses strategies for managing the risks.

Read the article (german only)

The Obligation to Monitor Under Section 11(2), Sentence 4 of the BDSG in the Age of Cloud Computing

By Annika Selzer

DuD, Issue 4, 2013

If a company uses a cloud computing service, for example, to manage customer or employee data, this generally constitutes commissioned data processing under Section 11 of the BDSG. As the client, the company is obligated to monitor the contractor—both before data processing begins and subsequently on a regular basis—to ensure compliance with the technical and organizational measures implemented by the contractor, and to document the results. An on-site inspection does not seem realistically feasible in the age of cloud computing. This article therefore examines alternatives to on-site inspections.

Read the article (german only)

Is Your Smartphone Cheating on You?

By Jens Heider and Rachid El Khayari

DuD, Issue 3, 2012

Smartphones have long since established themselves as practical all-around tools and have become an indispensable part of everyday business life. However, securing them has become just as essential as the ubiquitous use of their diverse functions. This article presents the most important attack vectors that should be taken into account when securing a business in order to maintain control over the information being used.

Read the article (german only)