Germany Clears Its Spies to Hack and Sabotage

A 732 page bill cleared the German cabinet on 12 August 2026, and inside it sits a sentence postwar Germany spent eight decades avoiding: its intelligence services may break into foreign computers and switch them off. The government calls it the most extensive overhaul of BND and Verfassungsschutz law in the history of the Federal Republic. If you report on Germany or work with sources there, the fine print matters more than the headline.

Key Takeaways

• Germany's cabinet approved a 732 page reform of BND and BfV law on 12 August 2026, which the federal government calls the largest overhaul of German intelligence law in the Republic's history.
• The draft lets the BND penetrate and disable foreign IT systems, and gives the domestic BfV operational powers for the first time.
• Active measures would need Germany's National Security Council to declare a "Nachrichtendienstliche Sonderlage" plus a two thirds vote of the Bundestag's Parliamentary Control Panel.
• The Federal Constitutional Court gave lawmakers until 31 December 2026 to repair BND surveillance rules it struck down in October 2024, leaving 141 days from the cabinet vote.
• Reporters Without Borders Germany says the draft permits automated analysis of people who have given no cause for suspicion, reaching potential sources before they ever contact a journalist.

What Did Germany's Cabinet Actually Approve?

The cabinet approved a draft bill, not a law. Germany's federal government announcement confirms the package must still clear the Bundestag before any new power takes effect.

The draft also rewrites the plumbing. Under strategic surveillance the BND could hold telecommunications content for six months and traffic data such as IP addresses for twelve, and AI assisted analysis finally gets a statutory framework. Oversight is consolidated into the Unabhängiger Kontrollrat, which absorbs the G10 Commission's duties across all federal services.

What New Powers Do the BND and BfV Get?

The BND would gain the right to intervene rather than only observe. The government's own examples are penetrating the IT systems of chemical weapons laboratories or drone factories to sabotage production, and shutting down servers run by state sponsored hacker groups. The Record adds supply chain sabotage, including substituting faulty components into deliveries.

The domestic BfV is the more contested half. Per the same reporting it could block or reroute data traffic, alter transmissions in transit, corrupt data staged for an attack, disable equipment about to be used in one, and feed disinformation to extremists inside Germany. netzpolitik.org reports the hackback provisions require an immediately impending danger to a particularly weighty legal interest.

One widely repeated claim did not survive checking. Some coverage says the services could block payment flows; I could not confirm that in the government's materials or the German legal press, so treat it as unverified.

What Are the Limits on These Powers?

The draft puts a political trigger in front of the technical one. According to t-online, the National Security Council would first declare a "Nachrichtendienstliche Sonderlage", and the Bundestag's Parliamentary Control Panel would endorse that finding with a two thirds majority. Two thirds of a cross party panel means the opposition has to agree.

• Subsidiarity. The powers apply only where suitable police or military help cannot arrive in time, or where the measure runs on foreign territory.
• A named adversary, on a clock. The Record reports BND disruption operations require the agency president to declare that a named foreign power is persistently threatening German interests, a declaration expiring after twelve months and reviewed every six.
• No harm to persons. The Record also reports the bill bars measures intended to endanger life or physical safety. That wording rests on one outlet's reading, so check it against the parliamentary text.

This is not a mass surveillance bill aimed at ordinary inboxes. It authorizes action against systems, pointed outward at hostile states, with one domestic exception around influence operations that draws most of the criticism.

Why the 31 December 2026 Deadline Matters

The reform runs against a court clock. On 8 October 2024 the Federal Constitutional Court held in 1 BvR 1743/16 and 1 BvR 2539/16 that Section 5(1) sentence 3 no. 8 of the G10 Act, which let the BND run strategic domestic to foreign surveillance against cyber threats, violates Article 10(1) of the Basic Law. It stands transitionally, on conditions, only until 31 December 2026.

Most coverage frames this as Germany deciding to hack back. The sharper detail is the calendar. From the 12 August cabinet vote to the cutoff is 141 days, recess included, for the Bundestag to scrutinize 732 pages: roughly five pages of intelligence law per day. Deadline pressure is how the quiet provisions pass while the debate stays fixed on sabotage.

What Does This Mean for Journalists and Their Sources?

The risk to reporters sits in the analysis provisions, not the sabotage ones. In a statement published on 16 July 2026, Reporters Without Borders Germany argued the exception clauses are drawn so broadly they hollow out existing safeguards, swapping proof of concrete involvement in a threat for loose association. Advocacy officer Maximilian Jung: "Der BND darf Daten von Personen künftig auswerten, die keinerlei Anlass dafür geboten haben."

The structural problem should worry anyone running a tip line. Source protection assumes an existing relationship between journalist and source, but risk profiling built from bulk data reaches a would be whistleblower before that relationship exists, so the protection never attaches. RSF also faults the draft for leaving trojans against media professionals unregulated, with no prior approval and no notification that would let a target sue.

There is an uncomfortable symmetry. Earlier in 2026 German authorities warned that state hackers were hijacking Signal accounts belonging to politicians and journalists without malware, by abusing the linked device feature. Those phishing operations against German journalists hit exactly the people RSF says the reform protects less. Germany's answer to being hacked is offensive authority for its own services.

What This Means for Your Inbox

Nothing here lets German services read ordinary mailboxes at scale, and anyone saying otherwise is selling something. What widens is the handling of traffic already crossing German networks, and Frankfurt is one of the world's busiest internet exchange points.

German constitutional law has answered part of this. Ruling on 19 May 2020 in 1 BvR 2835/17, the Federal Constitutional Court held that German state authority is bound by the Basic Law even abroad, and that Articles 10(1) and 5(1) protect foreigners in other countries against BND surveillance, with targeted surveillance of journalists tied to qualified thresholds.

The practical takeaway is the boring one. Encryption protects a message body; it does not hide who wrote to whom, when, or how often, and metadata is exactly what a six or twelve month retention window preserves. Assume transactional records outlive the conversation, and treat device compromise as the realistic threat. The same logic applied when Pegasus spyware landed on the phone of the EU lawmaker investigating Pegasus.

What to Watch in the Bundestag

Three provisions will decide how the final law reads, and German legal press including Legal Tribune Online is tracking the drafting fights. Whether the two thirds requirement survives committee or softens into a simple majority a coalition can supply alone. Whether protection for Berufsgeheimnisträger, the confidentiality category covering journalists and lawyers, widens beyond measures aimed directly at them. And whether the Independent Control Council gets engineers, since an oversight body without them cannot audit automated analysis. Read the committee amendments, not the press releases.