Germany's parliament gives its spy agencies the power to hack and sabotage adversaries

Germany's Bundestag passed a reform of the country's intelligence laws on November 13, with 308 votes in favour, 190 against and 71 abstentions. According to the Bundestag, the foreign intelligence service BND and the domestic Federal Office for the Protection of the Constitution (BfV) gain powers to break into adversaries' IT systems, and the BND may act against threats itself: getting into the networks of chemical weapons labs and drone factories to sabotage production, or shutting down servers run by state hacking groups. Interior Minister Alexander Dobrindt called it a "reform of the century".

We covered the package in August, when the cabinet approved it. It has now passed with amendments from the interior committee.

What the agencies can do

The interior ministry describes access to other people's devices as a scale, from "low-intensity" measures, for example against a smart fridge, to serious intrusion into a privately used mobile phone. Among the ministry's examples: deleting stolen victim data from a hacking group's servers, or slipping faulty components into a delivery.

The rest is about data analysis:

• Biometrics and AI. The agencies get a legal basis to analyse large datasets with artificial intelligence and to match images against material found online.
• Freezing traffic data. The BND and BfV can order a telecom provider to preserve connection data that may be needed later, until the conditions for requesting it are met.
• Metadata. The BND can keep metadata from bulk surveillance for 13 months instead of 12, The Record reports.
• At home. The BfV gets a shorter list of covert measures, such as blocking or rerouting data traffic. It cannot use force against people.

Who oversees it

Hacking operations and active measures inside Germany need advance approval from the Independent Control Council. Its court-like panel grows from six to twelve members, and the council also takes over data protection oversight of the agencies from the federal data protection commissioner. Queries to chatbots and search engines are protected from BND surveillance in the same way as messages between people. Protections for doctors were strengthened, while critics say journalists and lawyers are left with weaker safeguards.

Who opposed it and why

The governing CDU/CSU and SPD voted in favour, the AfD and the Left voted against, and the Greens abstained. Green MP Konstantin von Notz backed the BND law but not the BfV part, citing "biometric internet matching without relevant thresholds" and the recruitment of minors as informants. He predicted the coalition would "run into real problems" at the Constitutional Court. Clara Bünger of the Left spoke of "AI mass surveillance" and said the agency would be able to enter homes and manipulate data without judicial oversight.

The AfD calls the law a "Lex AfD": an amendment lets the BfV restrict information-sharing with individual state intelligence offices, and decide this on its own in urgent cases. AfD MP Christian Wirth called the reform "an attack on the rule of law". The coalition says police and intelligence remain separate: the BfV steps in only when the police cannot.