Section 5 Protection against harmful software and threats to federal communications technology (1) In order to protect federal communications technology against threats, the Federal Office may 1. use automated processes to gather and evaluate protocol data generated by operating federal communications technology as necessary to recognize, contain or remedy disruptions to or problems with federal communications technology or attacks on federal communications technology; 2. use automated processes to evaluate data generated at interfaces of federal communications technology as needed to recognize and protect against harmful software. Unless the following subsections permit additional uses, the automated evaluation of these data must be carried out without delay and the data must be destroyed without a trace immediately after having been checked. The limitations on use shall not apply to protocol data which contain neither personal data nor data covered by telecommunications privacy. Internal protocol data of a government authority may be gathered only with the approval of the authority concerned. (2) Protocol data as referred to in subsection 1 first sentence no. 1 may be stored longer than specified in subsection 1 first sentence no. 1, but no longer than three months, if there are concrete indications that, if suspicion is substantiated under subsection 3 second sentence, these data could be needed to protect against threats arising from the harmful software found or to recognize and protect against other harmful software. Organizational and technical measures shall be used to ensure that data stored on the basis of this subsection are evaluated only using automated processes. The data shall be depersonalized, where this is possible using automated processes. Non-automated evaluation or use of data which allows the identification of the person to whom the data pertain shall be allowed only in accordance with the following subsections. If doing so entails repersonalizing depersonalized data, this process must be ordered by the president of the Federal Office. A record is to be kept of the decision. (3) Use of personal data beyond the restrictions specified in subsections 1 and 2 shall be permitted only when certain facts substantiate suspicion that 1. they could contain harmful software, 2. they could have been transmitted using harmful software, or 3. they could provide information about harmful software, and when the data must be processed in order to substantiate or dispel suspicion. If suspicion is substantiated, the further processing of personal data shall be permitted as necessary 1. to protect against harmful software, 2. to protect against threats arising from the harmful software found, or 3. to recognize and protect against other harmful software. Harmful software may be removed or disabled. Non-automated use of data in accordance with the first and second sentences may be ordered only by a Federal Office employee who is qualified to hold judicial 5/10