German parliament passes spy law giving agencies hacking, sabotage powers 308-190

The Bundestag approved the bill 308 votes to 190, with 71 abstentions, giving Germany’s foreign intelligence service, the BND, and domestic agency, the BfV, new covert powers. The law lets the BND hack foreign systems, disrupt supply chains and take down servers used by hostile state-backed hacking groups. The BfV receives narrower powers inside Germany, including blocking or rerouting data traffic, while remaining barred from using force against people.

The bill also authorizes both agencies to analyze large datasets with artificial intelligence and match biometric images against material found online. Interior committee amendments added authority to order telecom providers to freeze traffic data expected to be needed, preserving it until legal access conditions are met. The powers remain narrower than those in Britain, France and the United States, where providers can retain communications data for longer periods or preserve records without a court order under U.S. law.

Germany’s postwar spy reforms are politically sensitive because of Gestapo and Stasi memories, but Chancellor Friedrich Merz’s government framed the change as necessary against daily covert targeting. Chancellery chief Nina Warken said foreign powers disguise sabotage as accidents, espionage as business and propaganda as opinion. The law shifts the BND from reporting on threats to acting against them abroad, aligning Berlin’s tools with European partners while still excluding lethal paramilitary capabilities similar to France’s DGSE or the CIA’s Special Activities Center.

The change matters because it normalizes offensive cyber capabilities inside a major European democracy and gives intelligence agencies legal cover for operations that can affect infrastructure, companies and foreign networks. It follows German officials’ claims that Russia-linked activity has targeted critical systems and elections, including an air traffic control attack Germany attributed to APT28; the source does not detail independent technical confirmation. The new authority creates oversight questions around AI, biometrics and telecom data preservation.