BND: Offensive Cyber & Covert Access

Germany Drafts Law to Grant BND Powers for Physical Intrusion, Hacking, and Sabotage

BERLIN – The German Chancellery has drafted a legislative proposal that would radically transform the country’s foreign intelligence service, the Bundesnachrichtendienst (BND), from an information-gathering agency into an operative force with sweeping new powers. A draft bill, first reported by Süddeutsche Zeitung, WDR, and NDR, seeks to authorize the BND to conduct physical intrusions into private homes, deploy state malware, execute offensive cyberattacks, and carry out acts of sabotage abroad. The proposal represents one of the most significant expansions of surveillance and operational authority in the agency’s history, raising profound questions about constitutional protections and the future of democratic oversight.

The End of the Digital Airlock: Sanctioning Physical Intrusion for Spyware Deployment

At the heart of the proposed reform is a deeply troubling new authority: the power for BND agents to covertly enter private residences to install spyware on IT systems. This measure is explicitly designed to circumvent the robust protections of end-to-end encryption (E2EE) used by secure communication platforms. By gaining physical access to a target’s devices—laptops, smartphones, or servers—agents could implant the “Bundestrojaner” (Federal Trojan) to exfiltrate data before it is encrypted or after it is decrypted.

This “black bag” operation bypasses the technical challenge of breaking encryption by compromising the endpoint itself. While German domestic law enforcement and intelligence agencies possess similar, though highly controversial, powers, extending this capability to a foreign intelligence service marks a dangerous erosion of the long-standing legal principle of the inviolability of the home, enshrined in Article 13 of Germany’s Basic Law. Critics warn that while the authority is nominally limited to foreign targets, it poses a direct threat to German citizens, journalists, and activists traveling or residing abroad, whose fundamental rights under the European Convention on Human Rights (ECHR), particularly Article 8 (right to a private life), would be severely impacted.

A Mandate for Disruption: From Passive Collection to Active Measures

The draft law aims to officially shift the BND’s mandate from passive intelligence collection to active intervention through what the Chancellery euphemistically calls “operative follow-up measures.”

Sanctioned Sabotage

For the first time, the BND would be legally permitted to engage in acts of sabotage. This includes operations to “weaken opposing armed forces, manipulate weapons systems, or render technical infrastructure unusable.” This provision blurs the line between intelligence work and military action, granting the BND a mandate traditionally reserved for special forces. These actions would be triggered by a “special intelligence situation” declared by a National Security Council, subject to a two-thirds approval from the Parliamentary Control Panel—a safeguard that civil liberties groups fear could prove insufficient in a perceived crisis.

Offensive Cyber Operations and “Hackbacks”

The proposal also seeks to authorize the BND to conduct offensive cyber operations, including so-called “hackbacks.” In response to cyberattacks on German infrastructure, the agency would be empowered to attack the aggressor’s IT systems, disrupt communication networks, or reroute data flows. This policy overlooks the critical problem of attribution in cyberspace, where attacks are often routed through the infrastructure of innocent third countries. An ill-conceived “hackback” risks causing significant collateral damage, escalating international conflicts, and violating the sovereignty of uninvolved nations.

Expanding the Dragnet: AI, Biometrics, and Prolonged Data Retention

The new operational powers are complemented by a significant expansion of the BND’s data processing capabilities. The draft explicitly permits the use of Artificial Intelligence to analyze large datasets and greenlights the deployment of facial recognition software. Furthermore, it would extend the legal retention period for certain types of data from ten to fifteen years, a direct contradiction of the data minimization principles central to EU privacy law like the GDPR.

In a particularly alarming provision, the law would weaken protections for data belonging to minors, potentially allowing their information to be retained if it is deemed relevant to an investigation. Human rights organizations, including Reporters Without Borders (RSF) and the Society for Civil Rights (GFF), have fiercely condemned the proposal, arguing it creates a framework for disproportionate surveillance without adequate, constitutionally sound safeguards. These groups have already filed a complaint with the European Court of Human Rights, anticipating a severe clash with fundamental rights.

This legislative overhaul, if passed, would not merely grant new tools to an intelligence agency; it would redefine its very character. By codifying a “civil and military” mission, the German government is pushing the BND toward the model of an aggressive, interventionist service, fundamentally altering the balance between national security and the civil liberties it is meant to protect.