Despite rights warnings, the BND and domestic intelligence gain sweeping powers to break into homes, use AI for surveillance, and manipulate data.
With its final vote Friday, the Bundestag passed a sweeping reform of intelligence law. The Bundesrat, Germany’s federal upper house, will consider the bill next. Despite a last-minute appeal from a broad civil society alliance of civil rights advocates, legal aid groups and other organizations led by the Humanistische Union, the governing CDU/CSU and SPD parties ultimately prevailed in Parliament.
Supporters hail the law as a necessary response to an increasingly hybrid threat environment and the demands of a resilient democracy. Opponents call it a state overhaul that has forgotten history. The controversy centers not only on individual investigative powers, but also on a possible break with constitutional cornerstones that would undermine confidence in the rule of law’s constraints on security agencies.
One point constitutional law experts repeatedly raised during parliamentary deliberations and hearings before the Interior Committee was the weakening of the separation between police and intelligence agencies. The Federal Constitutional Court had consistently upheld the already extensive powers of the Federal Intelligence Service (Bundesnachrichtendienst, BND) and the Federal Office for the Protection of the Constitution (Bundesamt für Verfassungsschutz, BfV). It did so only on the strict condition that they were not given police powers to prevent threats. Although they had expanded tools for covert data collection, they were not given those powers.
The draft now passed breaks with that principle. Both agencies will gain operational powers that allow them to move into the realm of conventional police work. This blurs the line between police and intelligence agencies, which was intended as a bulwark against state arbitrariness.
Covert home entries and hack-backs
Among the most serious changes, the BND will be authorized to secretly enter homes in Germany to prepare or carry out intelligence operations. This gives agents the legal authority to covertly enter private spaces to install spyware such as the government Trojan or conduct technical surveillance. Although special formal hurdles and prior review by the Independent Oversight Council (Unabhängiger Kontrollrat, UKRat) are required for homes in Germany and properties owned by German citizens abroad, this marks a new infringement on the inviolability of the home.
At the same time, the agencies will be allowed to launch hack-backs in response to cyberattacks. Experts consider this tool inefficient, technically risky and problematic under international law because it can lead to uncontrollable escalations.
These operational expansions are accompanied by a grab bag of surveillance tools. The bill paves the way for extensive real-time access to public video surveillance, the use of publicly available images and video for mass biometric matching without a specific threat, and automated data analysis.
The planned use of artificial intelligence also raises data protection concerns. Under the law, automated systems run by the BND and BfV will be able to make independent decisions to counter cyberattacks, triggering automated operational measures such as deleting or manipulating data without a human reviewing the process first. Internet providers can also be ordered to temporarily freeze existing traffic data as soon as there are specific indications that it may be relevant later.
Videos by heise
Press freedom at risk and inadequate oversight
The intelligence reform also puts professional confidentiality and press freedom under pressure. The draft does name traditional professions bound by confidentiality, such as doctors, psychotherapists and journalists. But in practice, it sharply limits their protection. If journalists obtain sensitive information in the course of their reporting, much of the existing protection no longer applies. Reporters Without Borders strongly criticizes the fact that, through the end of 2027, the BfV can order far-reaching measures against journalists without effective prior review.
For the BND, lawmakers made changes requiring an independent body to review targeted intrusions into source confidentiality. But the risks of surveillance remain high. A new criminal offense has also been added: Anyone who knowingly endangers Germany’s security or the intelligence agencies’ ability to operate by making audio or video recordings of agency properties and staff faces up to five years in prison. Because the exception for routine media coverage is narrowly defined, this is likely to seriously hamper journalists reporting from the scene. Experts say the oversight mechanisms meant to rein in these vast powers have not kept pace with the expanded authority of security agencies. The UKRat will receive more staff and organizational support. But it will still lack the necessary enforcement powers, adequate resources and a specialized procedural counsel to represent affected parties’ rights. In urgent cases, the agencies can still act on their own without prior approval. Effective requirements to notify people afterward remain scarce.
Strategic telecommunications surveillance through the DE-CIX internet exchange in Frankfurt is also effectively being expanded without limit, since the cap, given network capacity, covers nearly all data traffic. It is considered certain that Germany’s Federal Constitutional Court in Karlsruhe will soon have to examine whether the amendment itself, together with the existing powers of security agencies, creates an overall surveillance burden. The court will consider whether the sum of numerous powers exceeds constitutional limits.
(vbr)