BERLIN – A proposed German law would grant security agencies unprecedented authority to combat international cyber threats, according to draft legislation obtained by Reuters this week.
The new measures would enable German law enforcement to take direct action against digital attacks by disabling computer networks and removing data, even when those systems are located on foreign servers.
Germany’s push for stronger cyber defenses comes in response to Russia’s 2022 invasion of Ukraine, which has prompted the nation to strengthen both its military capabilities and intelligence operations to address hybrid warfare tactics. This represents a significant policy shift for a country that has historically been cautious about expanding security powers due to its Nazi-era history.
Interior Minister Alexander Dobrindt had previously stated that Germany needs enhanced capabilities to defend against international cyber threats, which German intelligence believes frequently originate from Russia. Russian officials have rejected claims that they conduct hybrid attacks against European nations.
The draft legislation states: “Like law enforcement, prevention of threats does not stop at national borders when it comes to combating cyberattacks.”
Under the proposed framework, authorities would not be permitted to conduct major offensive cyber operations, but they could reroute internet traffic, disable computer systems, and in severe situations, modify or eliminate data on servers abroad.
Most actions targeting private computer networks would need judicial approval, though emergency situations would allow authorities to seek court permission up to three days after taking action. The initiative would also require hiring hundreds of additional personnel.
The Federal Office for Information Security, known as BSI, would gain authorization to engage in “threat hunting” activities, enabling the agency to identify and neutralize cyber attack preparations before damage occurs, rather than responding after incidents happen.
Internet and digital service companies would be required to assist authorities under the new law, with non-compliance resulting in penalties reaching 20 million euros (approximately $23 million).
