Technical audit · 2026-05-29

bka.de

German Federal Criminal Police Office

Germany's Federal Criminal Police Office — the central body of the criminal police. 109 requests, 1 domain. BundesSans and BundesSerif served locally. Matomo via an opt-in checkbox. matomo.js loads locally (+102 ms), but no tracking requests appear in the HAR — consent has not been given. Wanted-person notices (Fahndungen) — all data local.

Timeline of the leak

+98 ms · CSS load
addon_cookiebanner.css and addon_fahndungen.css — styles for the cookie banner and wanted-person notices load as part of the main CSS bundle.
+102 ms · Matomo JS
www.bka.de/SiteGlobals/Frontend/JavaScript/addons/matomo.js — Matomo JS loads locally, as a built-in CMS addon. It does not initiate any external requests.
+170 ms · JS and fonts
global.js — the only main JS file. BundesSansWeb (Regular, Bold, Italic) and BundesSerifWeb (Regular) — served locally from /static/fonts/.
+427 ms · cookie banner
www.bka.de/CookieBannerExtended.html — the extended cookie banner loads. No Matomo tracking requests appear: consent has not been given.
No external domains
109 requests — all to www.bka.de. Fahndungen (wanted-person notices) with photos of wanted individuals — all local. Set-Cookie — zero.

Declared versus actual

Matomo/PIWIK — documented with an opt-in checkbox and Art. 6(1) DSGVO — заявлен
IP anonymization — 'two bytes of the IP address are anonymized' — заявлен
Double opt-in for the job newsletter — documented — заявлен
Contact form (Kontaktformular) — Art. 6(1)(a) Einwilligung — заявлен

Context

BKA (Bundeskriminalamt) is Germany’s federal criminal police office, the central body of the criminal police. It coordinates investigations into international crime, terrorism, and cybercrime. It publishes a Fahndungsportfolio — wanted-person notices with photographs of individuals being sought. Sensitivity is high: site visitors may be victims, witnesses, or persons otherwise interacting with the criminal justice system. HAR: 109 requests, 1 domain.

Matomo as a CMS addon — no external requests

matomo.js loads locally from www.bka.de/SiteGlobals/Frontend/JavaScript/addons/matomo.js at +102 ms — as a built-in part of the CMS, not an external resource. This matters: a request to a file on the proprietary domain does not mean tracking has been activated. There is no tracking request to a Matomo server (matomo.php) in the HAR — the user has not given consent, and the analytics tool is not activated.

The policy describes Matomo with opt-in: “Diese Daten verarbeitet das BKA nur, wenn Sie der Verarbeitung zustimmen bzw. die Webanalyse aktivieren. Es wird Ihnen hierfür beim erstmaligen Aufruf der Seite ein entsprechendes Auswahlfenster angezeigt.” CookieBannerExtended.html loads at +427 ms with options for “Webanalyse aktivieren” / “Webanalyse deaktivieren.”

Fahndungen — wanted-person notices, local

BKA’s homepage includes active wanted-person notices: photographs related to the “Doppelmord Bistro Raun” case, as well as a “SpurlosVerschwunden” (missing persons) section. All images — /SharedDocs/Bilder/DE/IhreSicherheit/Fahndungen/ — are hosted locally. There are no external services (Facebook, Twitter) for distributing the wanted-person notices — which would be problematic from the standpoint of transmitting data about visitors seeking information on criminal cases.

addon_bitv.css and accessibility

The list of CSS files includes addon_bitv.css — styles for BITV 2.0 (Barrierefreie-Informationstechnik-Verordnung, Germany’s web accessibility standard). Accessibility is implemented through proprietary styles, with no external SDKs.

Conclusion

bka.de is the seventh zero result in the German series. The federal criminal police office has built an architecture consistent with the sensitivity of its content: one domain, local Matomo as a CMS addon, correct opt-in, wanted-person notices with no external dependencies. The pattern among Germany’s federal security bodies is consistently reproduced: Bundespolizei, BAMF, BBK, BMJV, BND, BSI, BKA — all seven with zero external domains.

Evidence
Original (audit)
HAR file: de/bka-de-2026-05-29.har
SHA-256: 9c77c4d00d2eeb2421dc30c36136c393729d4104d68ba55d40129ffb05921f44
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.