BERLIN — Germany is working on landmark legislation that would dramatically expand what its intelligence agencies are allowed to do, giving them the ability to hack into foreign systems, spread disinformation, and disrupt hostile operations, according to a draft law reviewed by Reuters.
For decades, German spy agencies have operated under some of the tightest restrictions in the world. In the aftermath of World War Two, the country’s lawmakers deliberately prevented any single security body from accumulating too much power. As a result, the agencies have largely been confined to observing and reporting on threats rather than actively countering them.
The proposed legislation is being driven by what the German government describes as a growing threat environment, particularly from Russia. Officials want their services to be able to do more than simply watch — they want them to be able to act.
The draft law would rewrite the legal foundations governing both the domestic security agency and the foreign intelligence service, establishing a unified framework for covert activities, with a particular focus on operations carried out in cyberspace.
Under the interior ministry’s proposal, threats would be sorted into categories that would determine what level of response is permitted — ranging from basic surveillance all the way up to what the draft describes as “particularly serious” monitoring measures.
Most significantly, the agencies would gain the ability — for the first time — to interfere with the technical infrastructure of those attacking Germany, and to deliberately plant false information to mislead hostile actors.
In the digital realm, and under strict conditions, agents could break into the computer systems of adversaries, copy or erase data, and neutralize tools being used in foreign state-sponsored campaigns — including during large-scale cyber attacks.
The draft also addresses how government spyware may be used for online searches and for intercepting communications at the source. Companies operating in telecommunications, digital platforms, transportation, and financial services would be subject to secret, legally binding orders to hand over information. Failure to comply could result in fines reaching up to €1 million, and firms could face on-site inspections.
The legislation also spells out clearer rules around the use of confidential informants, including provisions that could, in the most serious threat scenarios, allow individuals as young as 16 years old to assist in investigations.
To ensure accountability, the draft proposes the creation of a new independent oversight body called the Independent Control Council. This single watchdog would replace the current patchwork of oversight agencies, combining authority over wiretap approvals and data protection. It would be required to pre-approve the most invasive intelligence activities, including extended undercover operations and surveillance conducted inside private homes.
