Germany moves to give spy agencies hacking and sabotage powers

Germany’s cabinet approved legislation Wednesday that would let its intelligence agencies hack foreign systems, sabotage adversaries’ supply chains and feed false information to extremists inside Germany, in the biggest overhaul of the country’s spy laws of the postwar era.

Chancellery chief Nina Warken said the new powers could allow the agencies to substitute faulty components into deliveries, use cyber operations to sabotage drone factories or chemical weapons laboratories and disable servers run by hostile state-sponsored hackers and disinformation operators.

Intelligence reform is a sensitive subject in Germany, where the shadows cast by both the Gestapo and Stasi remain within living memory. But, as with the country’s increased military spending following Russia’s invasion of Ukraine, the government has pointed to a rapidly changing threat environment to justify the legislation.

The 732-page bill, which has yet to clear parliament, comes as Germany has faced numerous drone incidents, terrorist attacks and other threats in recent years.

Interior Minister Alexander Dobrindt told reporters after the cabinet meeting that the government was “expanding the technical capabilities of the intelligence services and granting them active, operational powers,” adding that it was “about being able to take active measures against our attackers and adversaries.”

The draft bill rewrites the laws governing both Germany’s foreign intelligence service, the BND, and its domestic agency for the protection of the constitutional order, the BfV. It also requires telecommunications carriers and digital service providers to assist the agencies, enforced by powers that could result in fines or the services being suspended.

No license to kill 

The proposed powers stop well short of those exercised by some of Germany’s closest allies. The bill bars the intelligence agencies from measures intended to endanger a person’s life or physical safety, leaving the BND without anything resembling the paramilitary capabilities of France’s DGSE or the CIA’s Special Activities Center.

Where Britain’s legislation is infamously coy — with no avowed paramilitary arm but a statutory immunity provision that allows the government to authorize acts abroad that would otherwise be unlawful — the explicit language of the German draft provides a narrower set of powers than those available to counterparts in Paris, Washington and London.

Such work in the shadows — particularly the legal shadows — sits uneasily with Germany’s rule-of-law tradition, a foundation that helped produce the bill itself. Although the government has leaned heavily on the threat picture to justify the reforms, their immediate legal origins lie in a Federal Constitutional Court ruling that struck down a state intelligence law on the grounds that surveillance powers had to be calibrated to the intrusiveness of the measure involved.

Under the draft, BND disruption operations would require the agency’s president to declare formally that a named foreign power was persistently and systematically threatening German interests. The declaration would expire after 12 months and have to be reviewed every six.

Operations would have to be directed at the responsible state rather than individuals, and conducted outside Germany wherever doing so would be equally effective. Telecommunications carriers and digital service providers could be compelled to assist and would be compensated for doing so.

The domestic service, the BfV, gets a shorter list of powers, but one that would mark a significant departure from existing German law. Until now, the agency has principally been empowered to gather intelligence rather than intervene operationally. Under the draft, it could block or reroute data traffic, alter transmissions in transit, corrupt data stored for use in a plot, and disable equipment about to be used in an attack.

It could also feed false information to the people involved — a domestic disinformation power aimed at people inside Germany, for which no equivalent statutory authority exists in British, French or American law.

Britain, France and the United States regulate how intelligence authorities collect and process data, but the German proposal goes further by placing specific statutory controls on certain inferences generated from it.

Regulating AI analyses

The bill also breaks new ground in regulating how the intelligence agencies use artificial intelligence to analyze data.

It authorizes self-learning systems for intelligence analysis, but prohibits discriminatory algorithms and requires machine-generated outputs to be spot-checked under the supervision of an officer qualified to serve as a judge.

It also treats some conclusions generated by those systems as intrusions in their own right. Analytical products such as movement profiles, behavioural and personality assessments, and personalized predictions would require additional justifications before an analyst could retrieve them, with the threshold hinged on how revealing the output is.

A new oversight body would have to review every two years whether new categories of machine-generated output had become similarly revealing, in which case the stricter rules would apply automatically.

Opposition parties have raised differing criticisms of the bill, but it is likely to pass parliament given the governing coalition’s majority and its stated aim of having the law in force next year.

In the same judgment that prompted the reforms, the Federal Constitutional Court said Germany’s intelligence agencies could operate at lower legal thresholds than the police in part because, unlike police forces, they lacked operational powers. Civil liberties groups have said they plan to challenge the draft legislation.