Germany Moves to Give Spy Agencies Hacking and Sabotage Powers

Executive Summary

Germany's cabinet on Wednesday approved a 732-page draft bill that would grant its intelligence agencies unprecedented offensive cyber powers, including the authority to hack foreign systems, sabotage adversaries' supply chains, and feed false information to extremists inside the country. Chancellery chief Nina Warken said the new capabilities could allow agencies to substitute faulty components into deliveries, use cyber operations to sabotage drone factories or chemical weapons laboratories, and disable servers run by hostile state-sponsored hackers. The legislation, which still must clear parliament, represents the most significant overhaul of Germany's spy laws in the postwar era.

Technical Analysis

The draft bill rewrites the legal frameworks governing both the Bundesnachrichtendienst (BND), Germany's foreign intelligence service, and the Bundesamt für Verfassungsschutz (BfV), its domestic agency for protecting the constitutional order. Interior Minister Alexander Dobrindt told reporters the government was "expanding the technical capabilities of the intelligence services and granting them active, operational powers," adding it was "about being able to take active measures against our attackers and adversaries."

For the BND, disruption operations would require the agency's president to formally declare that a named foreign power was persistently and systematically threatening German interests. The declaration would expire after 12 months and require review every six. Operations must be directed at the responsible state rather than individuals and conducted outside Germany wherever equally effective. Telecommunications carriers and digital service providers could be compelled to assist and would be compensated.

The BfV, which until now has principally gathered intelligence rather than intervened operationally, would gain the ability to block or reroute data traffic, alter transmissions in transit, corrupt data stored for use in a plot, and disable equipment about to be used in an attack. It could also feed false information to the people involved — a domestic disinformation power aimed at people inside Germany, for which no equivalent statutory authority exists in British, French, or American law, according to the report.

The bill also breaks new ground in regulating AI use. It authorizes self-learning systems for intelligence analysis but prohibits discriminatory algorithms and requires machine-generated outputs to be spot-checked under the supervision of an officer qualified to serve as a judge. Analytical products such as movement profiles, behavioral and personality assessments, and personalized predictions would require additional justifications before retrieval, with the threshold hinged on how revealing the output is. A new oversight body would review every two years whether new categories of machine-generated output had become similarly revealing, in which case stricter rules would apply automatically.

The proposed powers stop well short of those exercised by some allies. The bill bars measures intended to endanger a person's life or physical safety, leaving the BND without paramilitary capabilities comparable to France's DGSE or the CIA's Special Activities Center.

The legislation's immediate legal origins lie in a Federal Constitutional Court ruling that struck down a state intelligence law, holding that surveillance powers had to be calibrated to the intrusiveness of the measure involved. In that same judgment, the court said Germany's intelligence agencies could operate at lower legal thresholds than the police in part because, unlike police forces, they lacked operational powers.

Mitigations & Recommendations

Defenders should monitor the bill's progress through parliament and its implementation timeline, as the government aims to have the law in force next year. Telecommunications carriers and digital service providers operating in Germany should prepare for potential compulsory assistance obligations, including compensation mechanisms. Organizations with European operations should assess how the expanded BND and BfV powers — particularly the novel authority to alter data in transit and feed disinformation — might affect their threat models and incident response planning. Civil liberties groups have announced plans to challenge the draft legislation, which could delay or alter its implementation.