Germany seeks new powers for spies to hack and disrupt foreign attackers

Germany is preparing a major overhaul of its intelligence laws that would give spy agencies new powers to hack hostile systems, disrupt cyber operations and deceive foreign attackers.

The proposed changes, contained in a draft law seen by Reuters, would mark a significant shift for German intelligence services, which have traditionally operated under tight postwar limits designed to prevent security agencies from accumulating excessive power inside the state. The reform comes as Berlin grows increasingly concerned about cyberattacks, sabotage, espionage and hybrid threats linked to foreign states, particularly Russia.

Under the draft, Germany’s domestic and foreign intelligence services would gain a single legal framework for covert operations, with new threat categories determining which powers can be used. Lower level cases would permit basic monitoring, while the most serious threats could unlock more intrusive surveillance and active cyber measures.

For the first time, the services could be allowed to interfere directly with hostile infrastructure. In cyber operations, that could include breaking into attackers’ IT systems, copying or deleting data, disabling tools used in foreign state campaigns and disrupting large scale cyber operations before they cause further harm. The draft would also allow targeted deception measures in certain circumstances.

The proposal would also create new rules for state spyware, including online searches and source telecommunications surveillance. These tools can allow authorities to monitor communications before they are encrypted or after they are decrypted on a user’s device, making them among the most sensitive powers available to security services.

Private companies would also face new obligations. Telecom providers, digital platforms, transport operators and financial intermediaries could be served with secret disclosure orders requiring them to hand over data. Refusal could trigger fines of up to €1 million, as well as on site inspections, according to the draft.

The law would also clarify the use of confidential informants. In the gravest cases, intelligence agencies could be permitted to use people as young as 16 to help uncover serious threats, a provision likely to attract close scrutiny from lawmakers and civil liberties groups.

To balance the expanded powers, the draft would replace Germany’s fragmented oversight structure with a new Independent Control Council. The body would combine wiretap approval and data protection oversight, and would be required to pre approve the most intrusive measures, including long term undercover deployments and surveillance inside homes.

Germany already has multiple bodies overseeing intelligence activity, including the Parliamentary Oversight Panel, the G10 Commission, the Federal Commissioner for Data Protection and Freedom of Information, and the Independent Oversight Council. The current system gives different bodies overlapping roles in monitoring surveillance, data protection and telecommunications secrecy.

The proposed changes form part of a broader German effort to modernise cyber defence. Earlier this year, Reuters reported on separate draft plans that would give law enforcement and security authorities greater powers to intervene against foreign cyberattacks, including shutting down IT systems, redirecting data traffic and deleting or altering data on foreign servers in serious cases.

The move is politically sensitive. Germany’s security architecture has long been shaped by historical concerns over state surveillance, including abuses under the Nazi regime and East Germany’s Stasi. Any expansion of intelligence powers is therefore likely to face debate over proportionality, legal safeguards and democratic oversight.

Supporters of the reform argue that Germany’s intelligence services need the ability to do more than observe hostile activity, particularly as cyber campaigns, influence operations and sabotage attempts become more sophisticated. Critics are expected to question whether stronger operational powers could weaken privacy protections or expand secret state action beyond what oversight bodies can realistically control.

The draft law has not yet completed the legislative process, and its final shape may change. But the direction is clear: Germany is moving toward a more active intelligence posture in cyberspace, one designed to disrupt foreign threats before they can reach German networks, institutions and citizens.

Photo Credit: DepositPhotos.com