Germany’s BND and BfV Intelligence Reform: Berlin Grants Active Cyber Powers to Counter Hybrid Threats

The tension is not incidental. It is the central issue.

From warning system to active defence

For decades, Germany's intelligence services have largely been designed to identify threats, gather information and pass it to those responsible for taking action. That model is increasingly difficult to sustain when the threat itself operates below the threshold of conventional war.

The government says Germany has faced sustained Russian cyber activity against logistics, energy infrastructure, government communications and air traffic control. Russian military intelligence-linked APT28 has also targeted networks connected to support for Ukraine. German authorities have reported the recruitment of low-level operatives through online networks for activities including arson, reconnaissance and other forms of sabotage.

The Leipzig/Halle airport incident, involving an explosive-laden drone found near Ukrainian cargo aircraft, has added a more physical dimension to those concerns.

Berlin's argument is therefore less about acquiring new technology than about changing what the state is legally allowed to do with it. Intelligence agencies that can identify an attacker but cannot disrupt the infrastructure behind the attack may be useful as observers, but they are limited as instruments of defence.

The draft would change that equation.

The BND would receive what the government calls active operational powers. These would include cyber countermeasures, such as accessing or shutting down foreign servers used by hackers or state-backed disinformation operations. It could remotely enter and disrupt foreign IT systems, including those belonging to facilities such as drone factories or chemical weapons laboratories. The legislation would also permit physical covert sabotage abroad, including the replacement of components with faulty ones or the substitution of explosives with inert material.

The boundaries are significant. Modified Article 51 of the Foreign Intelligence Service Act would continue to prohibit operations that directly endanger human life or physical health.

That distinction - between disabling an adversary's capability and causing physical harm - is likely to become one of the most important legal questions surrounding the reform.

The Russian threat is changing the German state

The broader significance lies in what prompted Berlin to cross this line now.

Germany is Europe's largest economy and a critical NATO logistical hub. Its infrastructure, companies and transport networks connect much of the continent. A successful attack on German systems can therefore have consequences well beyond Germany itself.

Yet the briefing behind the legislation acknowledges another vulnerability: Berlin has relied heavily on intelligence supplied by allies, particularly the United States and Britain. The proposed reform is partly an attempt to reduce that dependence by giving German agencies greater technical and operational capacity of their own.

This is a different conception of national security.

The relevant battlefield is no longer confined to borders or military installations. It includes servers, supply chains, logistics networks, private companies and digital platforms. A state seeking to disrupt another country's war effort does not necessarily need to launch a conventional attack. It can recruit a temporary operative, compromise a network, interfere with transport or spread disinformation.

Germany is responding by trying to make its intelligence services capable of acting across the same terrain.

That creates an awkward question for Berlin: how far can a liberal democracy adopt the methods of grey-zone conflict without changing the character of the state defending it?

The domestic boundary is even more contentious

The BND provisions are only half of the reform. The proposed expansion of the BfV reaches directly into the domestic sphere and is likely to generate the fiercest constitutional dispute.

The agency would gain broader authority to access and extract data from laptops, smartphones and other digital devices using state trojans. It would also receive new capabilities for automated, AI-driven analysis of large datasets and access to private surveillance-camera feeds.

Telecommunications companies, digital platforms, transport operators and financial institutions would be required to secretly provide requested information to intelligence agencies. Companies refusing to comply could face fines of up to €1m.

These provisions collide with Germany's Trennungsgebot, the post-war principle separating intelligence gathering from police powers.

The rule has deep historical roots. The abuses of the Nazi Gestapo and East Germany's Stasi helped shape a constitutional order in which surveillance powers were deliberately constrained, and state institutions were kept apart. Germany's intelligence agencies were not intended to become an all-purpose instrument of executive power.

The draft law would not formally erase that separation. But critics argue that giving the BfV the ability to penetrate personal devices and systematically process private data moves the agency much closer to the coercive capabilities that the post-war system was designed to contain.

That is why the dispute cannot be reduced to a conventional argument between security officials and privacy campaigners.

It concerns the architecture of the German state.

Oversight will determine how far the reform goes

The government has sought to address that concern by creating an Independent Control Council with responsibility for approving particularly intrusive operations in advance, including long-term wiretapping and searches of residential premises.

Whether that mechanism is sufficient will become one of the central parliamentary and legal questions.

The Gesellschaft für Freiheitsrechte and the German Bar Association have warned that the use of state trojans, offensive cyber operations and what they regard as inadequate judicial safeguards could make parts of the legislation unconstitutional. Opposition to the domestic provisions is also coming from the FDP and the Left, while the Greens have distinguished the two halves of the reform.

Konstantin von Notz, the Greens' deputy faction leader, supports expanding the BND's foreign capabilities but opposes the broader domestic powers for the BfV. Wolfgang Kubicki of the FDP and Clara Bünger of Die Linke have warned against creating something resembling a secret police.

That divide is revealing. The political question is no longer simply whether Germany needs stronger intelligence capabilities. There is growing acceptance of the premise that it does. The argument is over where those capabilities should stop.

A new European security model in miniature

The German debate matters beyond the Bundestag because the country sits at the centre of Europe's security infrastructure.

A more capable German intelligence service could strengthen NATO and EU security cooperation, particularly in protecting logistics and critical infrastructure. It would also give Berlin greater ability to respond without waiting for intelligence or operational support from foreign partners.

But greater autonomy comes with greater responsibility.

Once intelligence agencies are authorised to disrupt foreign computer systems or interfere with hostile supply chains, the distinction between intelligence collection and active defence becomes harder to maintain. Once domestic agencies can secretly penetrate personal devices and obtain data from private companies, the traditional boundary between intelligence work and law enforcement becomes harder to defend.

Germany is therefore trying to solve two problems at once: the strategic weakness created by an increasingly aggressive grey-zone environment and the constitutional risks created by giving the state more powerful tools to confront it.

The first problem is immediate. The second is structural.