Germany has approved a major overhaul of its intelligence legislation, granting national security agencies broader authority to respond to foreign cyber threats. The changes include powers to conduct certain offensive cyber operations, interfere with hostile digital infrastructure and use artificial intelligence to analyse information relevant to national security.
The Bundestag approved the legislation on November 13, 2026, with 308 votes in favour, 190 against and 71 abstentions. The decision follows months of discussions within the German government about strengthening the country’s response to cyberattacks, foreign interference and threats to critical infrastructure.
The reform represents a significant change in the role of German intelligence agencies, moving beyond traditional intelligence gathering towards more direct intervention against suspected hostile activities.
BND and BfV Receive Expanded Cybersecurity Authority
The legislation expands the powers of two major German intelligence organisations: the Federal Intelligence Service (BND), responsible for foreign intelligence, and the Federal Office for the Protection of the Constitution (BfV), which focuses on domestic threats.
Under the new framework, the BND will be authorised to undertake certain active measures against threats originating outside Germany. These may include operations intended to interfere with foreign computer networks and disrupt digital infrastructure associated with hostile cyber activities.
The legislation also identifies facilities and infrastructure potentially connected to serious national security threats, including drone manufacturing operations and chemical weapons laboratories.
Germany’s Interior Minister Alexander Dobrindt described the changes as a major reform designed to strengthen the country's intelligence capabilities in an increasingly complex security environment.
The BfV will receive more limited authority within Germany, including the ability to block or redirect data traffic in specified circumstances. However, the legislation maintains restrictions against intelligence agencies using physical force against individuals or conducting operations that endanger human life or physical safety.
Artificial Intelligence and Digital Surveillance Included in Reform
Another important element of the legislation is the expanded use of artificial intelligence and data analysis by intelligence agencies.
The new framework provides a legal basis for analysing large datasets with AI and comparing biometric images against information available online. These capabilities are intended to support investigations, identify potential security threats and help agencies assess digital information.
The legislation also gives both agencies authority to require telecommunications providers to temporarily preserve certain categories of data before access is granted under applicable legal conditions.
A further change concerns the retention of metadata collected through bulk surveillance. The BND's permitted retention period will increase from 12 months to 13 months.
The BfV will also gain authority to investigate organised crime groups that support extremist activities, an area previously handled primarily by police authorities.
At the same time, the amendments include protections for communications involving German citizens, including messages and queries sent through chatbots and search engines. These provisions are intended to establish boundaries around the collection and examination of personal digital information.
Independent Oversight to Monitor Intelligence Operations
The expansion of intelligence powers has also raised questions about privacy, accountability and the possibility of excessive surveillance. To address these concerns, the legislation introduces additional oversight requirements.
Certain hacking operations and active measures conducted within Germany will require prior approval from the Independent Control Council, the body responsible for supervising intelligence activities.
The government has also expanded the council's membership from six to twelve members, with the stated aim of strengthening its oversight capacity.
These controls are particularly important because the agencies will be able to use more intrusive digital capabilities. Their implementation will depend not only on the powers granted by law but also on compliance with the required approval procedures and legal safeguards.
Cybersecurity and Privacy Debate Likely to Continue
The reforms come amid growing concerns about cyberattacks, foreign interference and disinformation campaigns targeting German institutions. German officials have previously raised concerns about suspicious digital activities attributed to foreign state-backed actors and threats to critical infrastructure.
Supporters of the changes view stronger intelligence capabilities as necessary to respond to increasingly sophisticated security threats. Critics, however, may question whether expanded surveillance and intervention powers could affect privacy rights, freedom of communication and government accountability.
For businesses and institutions, the legislation also highlights the importance of understanding cyber risks, protecting sensitive information and strengthening internal security oversight. A structured internal audit and risk-control framework can help organisations assess governance processes and identify weaknesses in their own control systems.
Germany's decision reflects a wider international debate: how governments can strengthen national cybersecurity and respond to hostile digital activity without weakening the legal protections and individual rights that democratic societies are expected to uphold.