Germany Expands Spy Powers for Cyberattacks and Covert Ops
Germany's Bundestag approved an intelligence law expanding spy agencies' operational and data retention powers.
Why it matters: Legal and compliance professionals must track how these powers affect privacy, oversight, and intelligence-police boundaries, impacting cross-border operations.
- The Bundestag passed the law on Nov 13, 2026, broadening powers of the BND and BfV intelligence agencies.
- The BND can conduct sabotage and cyberattacks abroad against targets like drone factories and hacker servers.
- The BfV gains authority to deploy spyware and disable weapons domestically when terrorism or espionage threats exist.
- The BND may retain intercepted communications for 6 months and metadata for 12 months without prior judicial review.
On November 13, 2026, Germany's Bundestag enacted legislation expanding the Federal Intelligence Service (BND) and the Federal Office for the Protection of the Constitution (BfV) covert operational and data retention powers. The BND handles foreign intelligence, while the BfV focuses on domestic protection.
Interior Minister Alexander Dobrindt stated the reforms respond to threats from terrorism and foreign powers. He said the changes transform agencies into "true intelligence services" capable of disruptive operations beyond surveillance, including sabotage abroad.
The new law allows the BND to conduct offensive cyber operations targeting foreign facilities such as drone manufacturers, chemical weapon laboratories, and servers linked to state-backed hacking groups. Meanwhile, the BfV can deploy spyware on domestic smartphones and disable weapons linked to confirmed terrorism or espionage risks.
Regarding data retention, the BND may now store intercepted communications for six months and associated metadata for up to twelve months without prior judicial or parliamentary approval. This has raised privacy concerns. Opposition lawmakers like Green Party's Konstantin von Notz warn this risks unchecked intelligence activity against citizens, while Left Party's Clara Bünger called it a step toward "a new German secret police."
Privacy advocacy groups such as the Federal Commissioner for Data Protection and Freedom of Information (BfDI) have urged stronger oversight mechanisms to balance security needs with civil liberties. Independent privacy expert Dr. Anna Schmitz told LegalTech Digest the law "introduces potentially invasive powers without adequate safeguards, raising serious legal and ethical questions."
For legal professionals advising corporate and compliance clients, these changes could affect data privacy frameworks, cross-border cybersecurity policies, and the legal boundaries between intelligence surveillance and police investigations.
Monitoring how courts interpret these provisions and how agencies apply them will be crucial for understanding future compliance risks. The full legal texts and government positions are available via the German Federal Ministry of the Interior.
By the numbers:
- Nov 13, 2026 — Date Bundestag passed the intelligence reform law
- 6 months — Duration BND may retain intercepted communications without prior review
- 12 months — Duration BND may store related metadata without judicial approval
Yes, but: Some security experts argue the expanded powers are necessary to counter evolving threats, but critics warn oversight mechanisms remain insufficient to protect citizens' rights.
What's next: Legal challenges to the law are expected, and the Bundestag may review implementation reports in 2027 to assess oversight effectiveness.