Germany’s cabinet approved draft legislation on August 12 that would create Germany spy agency hacking powers for its foreign and domestic intelligence services. The proposal would move the BND and BfV beyond their largely intelligence-gathering roles, though it is not law and still requires parliamentary approval.
The Federal Intelligence Service, or BND, handles foreign intelligence. The Federal Office for the Protection of the Constitution, or BfV, is the domestic service. Ministers say the overhaul is a response to espionage, sabotage, cyberattacks, extremism and other so-called hybrid threats, as well as Germany’s dependence on information from allied services. Those are the government’s assessments, not findings established by the bill itself.
What hacking and sabotage powers could German spy agencies get?
Chancellery chief Nina Warken said the BND could be allowed to interfere with hostile foreign systems and supply chains. Her examples included replacing delivery components with defective ones, accessing drone-factory or chemical-weapons-laboratory IT systems to disrupt them, and disabling servers used by state-linked hackers or disinformation operators, according to The Record and the Associated Press.
The draft puts conditions around those operations. The BND president would first need to make a formal finding that a named foreign power persistently and systematically threatens German interests. That finding would lapse after 12 months and require review every six months. Operations would be aimed at the responsible state rather than individuals and conducted outside Germany where that is equally effective, The Record reported.
The BfV’s proposed remit is domestic and more narrowly described, but it would still be a marked change. It could block or reroute data traffic, modify data while it is transmitted, corrupt data intended for use in a plot, and disable equipment about to be used in an attack. The draft would also let it provide false information to people involved in such activity, according to The Record.
Neither service would receive authority for measures intended to endanger someone’s life or physical safety. Interior Minister Alexander Dobrindt separately cited swapping explosives for harmless material as a possible intervention. The legislative boundary matters: German intelligence agencies have historically faced tighter operational limits than counterparts in some allied countries.
What oversight would apply to the proposed powers?
The bill would require telecommunications carriers and digital-service providers to assist the agencies in some cases. The Record reported that noncompliance could bring fines or suspension of services, while providers would be compensated for assistance.
It also contains unusually specific rules for intelligence agencies’ use of AI. Self-learning analytical systems would be permitted, but discriminatory algorithms would be prohibited. A judge-qualified officer would supervise spot checks of machine-generated results. Analysts would need further justification to retrieve especially revealing outputs, including movement profiles, behavioural or personality assessments, and personalised predictions.
Germany’s sensitivity to state surveillance is rooted in the abuses of the Nazi dictatorship and East Germany’s secret police, AP and AFP reported. Critics say the proposal weakens the traditional line between intelligence collection and police-style intervention, while civil-liberties groups have said they plan to challenge it. The government cites recent threats, including an explosive-laden drone found at Leipzig/Halle airport, but that incident remains under investigation and authorities had not publicly identified a responsible party.
This story draws on original reporting from The Record.
