Germany Considers New Law Allowing Cyberattacks by Intelligence Agencies

Germany is moving toward a significant shift in the operational approach of its intelligence agencies. After decades of strict limitations established following World War II to prevent the expansion of state security powers, Berlin is now considering empowering its agencies with offensive cyber capabilities. These would include disabling attacker systems, deleting their data, and digitally deceiving adversaries.

A report published by Reuters indicates that the German government is preparing a draft law that would authorize intelligence agencies to infiltrate and disrupt hostile systems as a stronger response to cyber and hybrid threats. The draft mandates that a supervisory council must approve the most intrusive operations. It also introduces new regulations concerning surveillance and data protection. Additionally, the law could impose secret orders on telecommunications companies, digital platforms, transport operators, and financial entities to provide specific data.

The German plan extends beyond traditional monitoring, granting agencies the ability to intervene directly in the infrastructure of attackers. This includes copying or deleting data and disabling tools used in campaigns conducted by foreign states, particularly in cases involving widespread threats. However, these powers carry significant political sensitivity, as they open a new dimension between national security protection and the risk of expanding covert surveillance. Furthermore, companies refusing to comply with orders may face fines of up to one million euros.