Germany is set to overhaul its post-war intelligence limits by granting spy agencies new powers to hack, disrupt, and deceive foreign attackers, according to a draft law seen by Reuters. The reform aims to harden the country's response to growing cyber and hybrid threats, particularly from Russia.
New Powers for Spy Agencies
The proposed legislation would rewrite the legal basis for the domestic security agency and foreign intelligence service, creating a unified framework for covert operations, especially online. For the first time, services would be allowed to interfere with attackers' infrastructure or deliberately spread targeted false information.
In cyberspace, under strict thresholds, agencies could break into attackers' IT systems, copy or delete data, and disable tools used in campaigns by foreign states. This includes specific threat situations such as large-scale cyber operations.
Graduated Response to Threats
The interior ministry plan introduces new threat categories that unlock graduated powers, from basic monitoring to “particularly serious” surveillance. The reform is a response to what Berlin sees as increased risks linked to Russia, with services seeking the ability to act as well as observe.
German spy agencies have been more tightly regulated than many foreign services, mostly limited to watching and reporting. After World War Two, lawmakers aimed to prevent any security body from becoming too powerful inside the state.
New Rules for Surveillance and Informants
The draft also sets new rules for the use of state spyware for online searches and source telecommunications surveillance. Telecoms, digital platforms, transport operators, and financial intermediaries would face binding, secret disclosure orders, backed by fines of up to €1 million and on-site inspections.
Rules on the use of confidential informants are spelled out in more detail, with exceptions that could allow the deployment of people as young as 16 to help uncover the gravest threats.
Independent Oversight Council
A new top-level watchdog, the Independent Control Council, would replace the current fragmented oversight bodies. It would combine wiretap approval and data-protection control and must pre-clear the most intrusive measures, including long-term undercover deployments and home surveillance.
