German Law Gives Spy Agencies Hacking and Sabotage Powers

Lawmakers approved the bill 308 to 190, with 71 abstentions. It is the biggest overhaul of German intelligence law since World War II, a sensitive topic in a country where memories of the Gestapo and Stasi remain.

What changes

• BND (foreign intelligence): can now act against threats abroad instead of only reporting on them, for example by disabling the servers of a government-backed group that steals data from critical infrastructure companies.
• BfV (domestic intelligence): gets a narrower set of covert powers at home, such as blocking or rerouting data traffic, while force against people stays with the police.
• Both agencies: gain a legal basis for AI analysis of large datasets, biometric image matching against online material, and ordering telecoms to "freeze" traffic data until legal conditions for access are met.

Safeguards

• Hacking and active measures inside Germany need prior approval from the Independent Control Council, whose panel doubles from 6 to 12 members.
• Measures that endanger a person's life or safety are banned.
• Germans' messages to chatbots and search engines get the same protection from BND surveillance as person-to-person communication.

Background

Berlin links rising attacks to its support for Ukraine. Last December it summoned Russia's ambassador over an attack on its air traffic control authority attributed to APT28 and over a disinformation campaign targeting its federal election.