German parliament passes law giving spy agencies hacking, sabotage powers

The Bundestag approved the bill by 308 votes to 190, with 71 abstentions, marking the most significant overhaul of Germany’s spy laws since the end of World War II.

The legislation, months in the making, rewrites the rules governing both the foreign intelligence service, the BND, and the domestic agency for the protection of the constitutional order, the BfV.

It gives the BND the power to act against threats abroad, including by hacking foreign systems and disabling servers run by hostile state-sponsored hackers.

New Powers and Oversight

The BfV receives a shorter list of covert powers inside Germany, such as the ability to block or reroute data traffic, but it remains prohibited from using force against people.

Both agencies gain a legal basis to analyze large datasets with artificial intelligence and to match images biometrically against material found online.

The reforms also include amendments that allow the agencies to order telecom providers to 'freeze' traffic data they expect to need, preserving it until legal conditions for access are met.

The bill bars the intelligence agencies from measures intended to endanger a person’s life or physical safety, leaving the BND without anything resembling the paramilitary capabilities of France’s DGSE or the CIA’s Special Activities Center.

The agencies’ hacking operations and active measures inside Germany will need advance approval from the Independent Control Council, the agencies’ oversight body.

This oversight body has been doubled from six to twelve members to strengthen its court-like panel.

Justification and Threats

Chancellery chief Nina Warken said foreign powers target Germany covertly every day, disguising 'sabotage as an accident, espionage as business dealings, and propaganda as an opinion.'

The government has pointed to a rapidly changing threat environment, including Berlin’s support for Ukraine, to justify the legislation.

Last December, Germany summoned the Russian ambassador over a cyberattack on its air traffic control authority, which it attributed to the hacking group APT28, and over a disinformation campaign aimed at influencing its federal election.

During that campaign, fake videos were circulated which appeared designed to foment discontent among supporters of the far-right Alternative for Deutschland (AfD) party.

Amendments and Political Controversy

Lawmakers on the interior committee made a series of last-minute amendments to the cabinet’s draft, including providing both agencies with the authority to investigate organized crime groups that support extremism.

Other changes stipulate safeguards that limit the agencies’ activities, including protecting Germans’ messages and queries sent to chatbots and search engines from BND surveillance.

The amendments also strengthen protections for doctors and other medical professionals, though critics note that journalists and lawyers are left with weaker safeguards.

One amendment drew fire from the far right, as it allows the BfV to restrict information-sharing with individual state intelligence offices if there are concrete indications that federal or state security interests are at risk.

The BfV had classified the AfD as a confirmed right-wing extremist group last year, but a court in Cologne put that label on hold while it considers the party’s legal challenge.

Until that challenge is settled, the agency is legally only permitted to monitor the AfD as a suspected extremist group.