Germany hands its spies powers to hack, sabotage and disrupt; and rewrites the post-war rulebook

What did the Bundestag actually vote for on Friday?

Germany’s parliament voted on Friday 13 November to give the country’s intelligence services powers they have never held since the Federal Republic was founded: the right not merely to watch a threat, but to strike at it. The Bundestag passed the reform by 308 votes to 190, with 71 abstentions, and the governing Christian Democrats and Social Democrats carried it while the far-right Alternative for Germany and Die Linke voted against and the Greens abstained. Interior Minister Alexander Dobrindt, who championed the bill, called it a “reform of the century”.

The vote crowned a process that began in the cabinet in August, when ministers approved a draft running to more than 700 pages, and it was driven by a hard deadline set by Germany’s own highest court. On 8 October 2024 the Federal Constitutional Court ruled that the BND’s strategic surveillance of telecommunications violated Article 10 of the Basic Law, and it found the oversight of the G10 Commission insufficient, yet it allowed the old rules to stand only until 31 December 2026. That date is why lawmakers voted now, and why the main provisions are scheduled to take effect on that same day. The immediate trigger was closer to home: in August, German authorities found an explosive-laden drone near a cargo plane of the Ukrainian firm Antonov Airlines at Leipzig-Halle airport, and Berlin formally accused Russia of attempting an attack there. Russia denied involvement.

What do the new powers let the two services actually do?

The reform transforms two agencies at once, and the change is sharpest for the BND, the foreign intelligence service. It will now be able to conduct covert operations abroad, including sabotage: penetrating the networks of chemical weapons laboratories and drone factories to disrupt production, shutting down the servers of state-backed hacking groups, disrupting disinformation networks, and interfering with the supply chains for weapons that could be used against Germany. Its domestic counterpart, the BfV, the Federal Office for the Protection of the Constitution, is no longer limited to gathering information, for it may now take protective action against property and IT systems when a specific threat is identified; dismantling explosives, diverting data flows during a cyberattack, deleting or falsifying data stored for malicious purposes, and planting false information,.

Both services gain the same digital toolkit: a legal basis to analyse large volumes of data with artificial intelligence and to match biometric data against material found online, powers to intercept encrypted communications and conduct online searches, and the right to order a telecommunications provider to freeze connection data that could be needed later. The BND may keep intercepted content for six months and metadata for up to a year without prior review,. Two hard lines remain: the services may not use force against people, and targeted assassinations stay strictly forbidden. Oversight changes too: the G10 Commission, which has reviewed wiretaps since 1968, is dissolved into a new Independent Control Council of twelve members.

What is still unclear the morning after the vote?

Several facts that look settled are not, and the first is the vote itself. Al Jazeera reports 308 votes in favour, while the BBC reports 309, with both agreeing on 190 against and 71 abstentions, and the one-vote gap has not been explained in the reporting available so far. A similar fog hangs over the retention periods, since some accounts put the BND’s metadata retention at twelve months and others, citing The Record, at thirteen, and the full text of a bill running beyond 700 pages has not yet been digested in public. Former data protection commissioner Ulrich Kelber has also warned of a gap: under the draft, his office would lose jurisdiction over complaints as soon as the law takes effect, while the new council would not take such requests until 2029.

Why does this vote redraw a line Germany drew in 1949?

The reform matters because it touches the deepest nerve in German public life, which is the memory of what unchecked secret services did. After the Second World War, Germany built a strict separation between intelligence gathering and police work, the Trennungsgebot, and for eight decades the BND and the BfV were confined to collecting information while only the police could make arrests. That firewall is why the debate is so charged, and why the Left Party’s security spokeswoman, Clara Bünger, told parliament that Dobrindt was creating a new German secret police, while the AfD, itself under surveillance by the BfV, warned the domestic service could turn into a “Stasi 2.0”.

It matters, too, because the government presents the change not as a choice but as a necessity imposed by a world that has turned hostile. Since Russia’s full-scale invasion of Ukraine in 2022, German authorities have sounded the alarm over suspected Moscow-backed sabotage, cyberattacks, disinformation campaigns and drone overflights near military sites, and the government names Russia, China and Iran as the sources of the espionage and hybrid activity now aimed at Germany. BND president Martin Jäger has called it an undeclared “shadow war”. Florian Bigge of the Körber-Stiftung put the motive in one sentence when he told Al Jazeera that “Russia is the main trigger: sabotage, cyberattacks and drones. Plus fear of US unpredictability and reduced US intelligence sharing.”

What does the 5D lens show behind the vote?

Geopolitics comes first, because the reform is a response to a threat the government names openly and repeatedly. Russia is the main trigger, in Bigge’s phrase, and the Leipzig drone, the sabotage warnings and the drone overflights near military sites form a single pattern that Berlin now treats as a campaign rather than a series of incidents, while China and Iran are named alongside Russia as sources of espionage and hybrid activity. Chinese military exercises around Taiwan have put every European capital on notice, and what is known about China’s drills is now part of the same conversation in Berlin as the drone over Leipzig. The decision is inseparable from a second fear Bigge named: American unpredictability and reduced US intelligence sharing.

Economics runs alongside the politics: €1.51 billion for the BND, up a quarter in a year, plus €350 million for the new technical capabilities. History explains why the price is paid so nervously, for the Gestapo and the Stasi are not distant history in German politics but living memory, and the debate in the Bundestag was conducted in their shadow from the first speech to the last. Technology makes the old law obsolete, because the threats are fought with code and data, and the race to govern AI-powered cyberattacks is now shared on both sides of the Atlantic. The five dimensions converge: Germany is rewriting the post-war settlement in the direction of power.

What happens the first time the new powers are actually used?

The first use will matter more than the vote, because it will convert an abstract law into a precedent, and the most likely first use is also the most delicate. If the BND disrupts a server farm run by a state-backed hacking group, or sabotages a drone production line, the target state will call it an act of aggression, and the question of whether the National Security Council declared a “special intelligence situation”, and whether two-thirds of the parliamentary oversight panel agreed, will be litigated in public within hours. If the BfV deletes stolen data, the operation will be invisible by design. Either way, the secrecy that makes the powers effective also makes them hard to check, and the first scandal, a wrong target, a leaked operation, a complaint with nowhere to go until 2029, will test whether the oversight the government promises is real or decorative.

What should readers watch before 31 December?

Three dates frame what happens next, and the first is the completion of the legislative process itself, since the main provisions are scheduled to take effect on 31 December only once the remaining steps are done. Readers should watch the Bundesrat, whose earlier opinion asked for changes including a precise cost calculation for the states, and watch whether the complaints gap Kelber identified is closed before the law takes effect. The second date is the staffing of the new Independent Control Council, which grows to twelve members with shorter terms, and the identity of its members will say more about the oversight than any speech in the Bundestag. The third is the first operation itself, which may never be announced. The wider contest over Ukraine; where Europe has just named its five-nation team for the peace talks; will shape whether the reform is read abroad as deterrence or as provocation.