Germany votes to let its intelligence services intervene

The Bundestag has passed two bills that would let Germany’s civilian intelligence and police agencies carry out disruptive cyber operations in peacetime. Neither is yet in force.

The Intelligence Services Reform Act, approved on 13 November, takes the foreign service, the BND, and the domestic service, the BfV, beyond observation. Both gain narrowly defined powers to intervene against serious threats where other authorities cannot act as effectively. The government’s own examples for the BND include sabotaging production at drone factories or chemical-weapons facilities, disabling servers run by state-sponsored hacking groups, and tampering with components in supply chains. These describe what the law would permit. They do not report operations that have taken place.

The Cybersecurity Strengthening Act, approved a day earlier, gives the Federal Criminal Police Office (BKA) and the Federal Police a separate route. They could interrupt threatening IT systems, redirect communications and, in qualifying cases, alter or delete attack-related data. Committee amendments rank data manipulation below less intrusive options.

The most intrusive police operations generally need a judge’s approval. Intelligence interventions face a prior legality check by the Independent Control Council, whose membership would double from six to twelve.

The cybersecurity bill has gone to the Bundesrat. The intelligence reform names 31 December 2026 as its start date, provided the remaining legislative steps are completed.

European governments have spent years learning to detect hostile cyber activity and attribute it. Germany is now building a legal route to interfere with the infrastructure behind it. A statute can authorise a cyber effect. The access and precision needed to deliver one have to be earned separately.