Bundestag passes law granting German spies hacking and sabotage powers

Germany’s Bundestag passed the biggest postwar overhaul of the country’s spy laws on Friday, Nov. 13, 2026, voting 308 to 190 with 71 abstentions to give intelligence agencies expanded hacking and sabotage powers.

Months after Chancellor Friedrich Merz’s cabinet signed off on the draft, the new law overhauls the statutes that govern the BND foreign intelligence service and the BfV domestic agency tasked with defending the constitutional order. The BND gains authority to act against threats overseas rather than merely report on them. Those powers allow the BND to retaliate with sabotage and cyber operations while broadening its ability to intercept and keep data.

Both agencies may analyze large datasets using artificial intelligence and compare online images through biometrics, which identifies people by physical traits. Within Germany, the BfV receives limited covert authority, including the ability to block or reroute data traffic, though it may not use force against people. Only law enforcement may use force against people, and targeted assassinations remain strictly prohibited.

The law also bars actions intended to endanger a person’s life or physical safety. Chancellery chief Nina Warken said the proposed powers could allow agencies to carry out cyber operations against drone factories or chemical weapons laboratories. Warken said the powers could also halt servers run by hostile state-sponsored hackers.

Warken said foreign powers conduct covert operations against Germany every day, disguising sabotage as accidents, espionage as ordinary business, and propaganda as opinion. Under the changes, the BND could act in cases where no other agency has authority. One example would be closing servers used by a state hacking group to take data from critical infrastructure companies.

Berlin has become more outspoken about these threats, a change officials tie to Germany’s backing of Ukraine. In December 2025, Berlin called in the Russian ambassador after a cyber attack on its air traffic control authority that Berlin attributed to APT28. Berlin also called in the ambassador over a disinformation campaign meant to influence its federal election. During that campaign, fake videos spread with the aim of angering supporters of the far-right Alternative for Deutschland party.

The videos showed the party as absent from ballot papers or displayed the destruction of ballots marked for the party. France’s DGSE and the CIA’s Special Activities Center have paramilitary capabilities that the BND does not have. Interior Minister Alexander Dobrindt said the powers would make Germany’s agencies true intelligence services on equal footing with European partners.

Lawmakers on the interior committee changed the cabinet draft in November 2026. The amendment permits both agencies to direct telecom providers to hold traffic data they expect to require until they satisfy lawful access conditions. The freeze power is narrower than comparable powers in Britain, France, and the United States.

British and French rules permit keeping communications data for as long as 12 months. Under the Stored Communications Act, American agencies can force providers to preserve records for up to 180 days even without a court order. The BND may keep metadata collected during bulk surveillance for 13 months instead of 12.

The BfV also gains authority to investigate organized crime groups linked to extremism, a responsibility normally reserved for the police. The changes also bolster safeguards for doctors and medical professionals, though critics say journalists and lawyers receive weaker protection. Hacking operations and active measures inside Germany require prior approval from the Independent Control Council.

The council’s court-like panel has grown from six members to 12. Far-right critics objected to an amendment that would permit the BfV to restrict intelligence sharing with state intelligence offices in individual states. The change demands agreement from most state offices, except in urgent cases when the BfV may act alone.

AfD lawmaker Christian Wirth described the measure as a Lex AfD intended to cut off states whose governments the coalition dislikes. In 2025, the BfV labeled the AfD a confirmed right-wing extremist group. A court in Cologne suspended that label while it weighs the party’s legal challenge.

Until the court resolves the challenge, the agency may legally watch the AfD only as a suspected extremist group. That status restricts the agency’s surveillance tools and public statements about the party. Agencies in two eastern German states, including Saxony and Thuringia, have separately labeled their local AfD branches as confirmed extremists.

The AfD has never led a state government, even though its support has grown in recent years. The AfD took 43.8% of the vote in Saxony-Anhalt in September 2026, its strongest state-election result ever, though still short of a majority. Two weeks after that, the AfD finished first in Mecklenburg-Western Pomerania. Saxony-Anhalt’s CDU-led caretaker government remains in office because other parties refuse to cooperate with the AfD.

BND chief Martin Jaeger warned that Moscow wages a shadow war against Germany using tools such as drones, espionage, sabotage, and disinformation. Russia represents the largest threat facing Germany. Security officials and German leaders say strengthening the BND foreign spy agency is necessary to counter rising threats from hostile foreign actors.

In the past, the country’s spy agencies have primarily gathered and analyzed intelligence, partly due to Germany’s experience with the Nazi Gestapo and the East German Stasi. Because the legacy of the Gestapo and the Stasi is still within living memory, intelligence reform remains a sensitive subject in Germany. The government pointed to a fast-evolving threat environment to justify the legislation.

Interior Minister Alexander Dobrindt called the legislation the “reform of the century.” Dobrindt said Germany serves as an operational theater for terrorism, extremism, and foreign powers.

Critics, including civil liberties groups, warn the reforms might erode privacy rights and sweep up innocent people’s private information through mass surveillance. Far-right and far-left opposition lawmakers fear the BfV could turn into a secret police. Defenders contend that oversight remains strong and that other European democracies already give their agencies similar or greater powers.