Germany Turns Its Spies Loose: Bundestag Licenses Sabotage and Hack-Back

Berlin has ended the post-war rule that its intelligence services may watch threats but never act on them.

Intelligence Lead

The Bundestag on Friday approved the most significant expansion of German intelligence authority since the Cold War, giving the BND and BfV legal power to sabotage, disrupt hostile servers, falsify adversary data and covertly enter homes. The reform converts both agencies from collectors into operators and ends Germany's long-standing doctrine that intelligence services observe while police act. Russia's hybrid campaign against German infrastructure is the explicit driver.

Situation Report

The intelligence services reform passed on 13 November with 309 votes in favour, 190 against and 71 abstentions, according to the BBC and LaPresse; Al Jazeera reported 308 in favour. The governing CDU/CSU–SPD coalition carried the bill. Die Linke opposed it, and Al Jazeera reports the AfD also voted against. Interior Minister Alexander Dobrindt, the measure's principal sponsor, called it the "reform of the century" and told parliament: "We are the target of hybrid threats."

For the first time, the domestic Federal Office for the Protection of the Constitution (BfV) may take protective action against property and IT systems once specific threats are identified. Reported powers include dismantling explosives or weapons, diverting or blocking data flows during cyber-attacks, deleting or falsifying data held for malicious purposes, planting false information on hostile actors and, with prior authorisation, covertly entering homes. The BfV also gains wider digital surveillance authority covering encrypted communications, online searches, AI-supported data analysis and biometric image matching on the internet.

The foreign intelligence service (BND) is authorised to conduct covert operations abroad, including sabotage, paralysing servers used by state-sponsored hacking groups, disrupting disinformation networks and interdicting weapons supply chains. Open arrests and searches remain reserved for the police, and a panel of former judges is to review the legality of certain measures in advance, according to LaPresse. Al Jazeera reports the main provisions are scheduled to take effect on 31 December 2026, pending completion of the legislative process.

The immediate trigger was the discovery in August of an explosive-laden drone at Leipzig-Halle airport near Ukrainian Antonov cargo aircraft. The device reportedly failed because of a faulty detonator. German authorities attribute the incident to Russia, which denies involvement. Opposition reaction was sharp: Clara Bünger, Die Linke's security spokeswoman, described the law to ARD as "a monster" and accused the government of creating a German secret police. Dobrindt dismissed the charge as "madness."

Background & Context

Germany's intelligence architecture was built on the Trennungsgebot, the separation principle imposed after 1945 to prevent a return of Gestapo-style fusion between secret intelligence and coercive policing. The Stasi experience in the East reinforced the taboo after reunification. German services have historically been treated by Five Eyes and French partners as capable collectors but constrained actors, dependent on allies for disruption operations and offensive cyber effects.

That constraint has become untenable under sustained Russian pressure: arson and parcel-bomb plots against logistics firms, drone overflights of military and industrial sites, cyber intrusions and influence operations. Florian Bigge of the Körber-Stiftung told Al Jazeera that "Russia is the main trigger: sabotage, cyberattacks and drones," and characterised the reform as a direct product of the Zeitenwende. The diplomatic temperature is already high: Berlin recently closed Russia's consulate general in Bonn and the Russian House in Berlin, and Moscow retaliated by shutting Germany's consulate in St Petersburg and the Goethe-Institut.

Analysis & Assessment

The reform is assessed as a doctrinal shift rather than an incremental update. The power to falsify adversary data and plant false information is an explicit licence for active-measures counterintelligence, a capability that places the BfV closer to the operating model of MI5 and the DGSI than to its own historical mandate. Hack-back authority for the BND gives Berlin an independent disruption option against Russian and Chinese state hacking groups for the first time, reducing dependence on US and UK effects.

A constitutional challenge is highly likely. The Federal Constitutional Court has repeatedly struck down or narrowed German surveillance legislation, including the BND Act in 2020. Die Linke's own parliamentary motion argues key provisions fail constitutional standards, and the covert home-entry and data-falsification powers are the most exposed. Expect Karlsruhe to become the decisive arena, with the ex-judge oversight panel central to the government's defence.

Operationally, the more immediate consequence is deterrence signalling toward Moscow. Russian services running sabotage proxies in Germany must now plan against an adversary authorised to disrupt in advance rather than merely report. Retaliation in the diplomatic and hybrid domains is probable, and the first attributable BND disruption operation will test both the law and Berlin's appetite for escalation.