German parliament passes law giving spy agencies hacking, sabotage powers

Germany’s Bundestag approved a major overhaul of intelligence laws by 308 votes to 190, with 71 abstentions, granting the foreign intelligence service BND authority to conduct cyber operations abroad rather than merely report on threats. It may hack foreign systems, disrupt hostile supply chains, and disable servers used by state-backed hackers. The domestic agency, BfV, receives narrower covert powers, including blocking or rerouting data inside Germany, but cannot use force against people. Both agencies may use AI to analyze large datasets and biometric tools to compare images found online. The government argues the expanded powers are needed to counter espionage, sabotage, and disinformation, including threats it links to Russia and Germany’s support for Ukraine.

The law also permits telecom companies to preserve traffic data on agency orders until legal access requirements are met, extends BND retention of bulk-surveillance metadata to 13 months, and lets the BfV investigate organized crime groups that support extremism. Safeguards protect Germans’ chatbot and search-engine queries as well as private messages, and strengthen protections for medical professionals; journalists and lawyers receive weaker guarantees. A court-like oversight body must approve hacking and active operations inside Germany in advance. Critics also object to a provision allowing the BfV to limit information-sharing with state agencies when security risks are identified, which the far-right AfD says could be used against its regional strongholds. The new powers remain more limited than those of some allied intelligence services and cannot endanger anyone’s life or physical safety.