What Germany's Intelligence Reform Decides

Germany's cabinet has agreed to a legal reform that gives the country's two main intelligence services — the foreign-focused Federal Intelligence Service (BND) and the domestic Federal Office for the Protection of the Constitution (BfV) — updated tools to respond to espionage, sabotage and hybrid attacks. The proposal is presented as a modernisation of rules that have not kept pace with threats in cyberspace.

The most visible change concerns the BND's strategic surveillance. Under the draft, it would be permitted to store the content of telecommunications for up to six months and traffic data — including IP addresses and the time and duration of connections — for up to twelve months. Berlin says this brings Germany back to the level of its international partners.

The reform also regulates the use of artificial intelligence for data analysis, allowing the services to evaluate large volumes of information more efficiently. In addition, both services would gain the power to take active protective measures in narrowly defined cases where other authorities, such as the police, cannot act as effectively. The government cites the example of shutting down a foreign server from which a cyberattack is imminent.

At the same time, oversight is being restructured. The Independent Control Council will take over the tasks of the G10 Commission and assume responsibility for all federal intelligence services. Particularly intrusive individual measures would require its prior approval, while parliamentary control through the established oversight body remains unchanged.

Advertisement

Why Berlin Is Granting New Powers and Centralising Control

Why Berlin is modernising now

The official justification is a changed threat picture: the government argues that espionage, sabotage and hybrid operations are increasingly digital and cross-border, making the existing legal framework inadequate. The proposed data retention periods for the BND are framed less as a radical expansion than as an alignment with partner services, a signal that Germany wants to remain interoperable in international intelligence cooperation.

The active-measures power is the sharpest departure

Traditional intelligence work is about gathering information. The new clause would allow the services to intervene directly — for example, by disabling a foreign server before a cyberattack. That is a meaningful shift from surveillance to action, but it is deliberately constrained: the services may act only where other state bodies cannot respond equally effectively, and the government says the power will remain subject to tight limits.

A single control body follows years of court pressure

The restructuring of oversight is not merely an addition to expanded powers; it responds to rulings by the Federal Constitutional Court that have demanded clearer, proportionate rules for surveillance measures. By replacing the fragmented G10 Commission with the Independent Control Council and requiring prior approval for the most intrusive individual measures, Berlin is trying to make the reform legally robust against the same constitutional challenges that have repeatedly slowed German security legislation.

From Cabinet Decision to Law: What to Expect in Germany's Spy-Agency Reform

The cabinet decision is only the first step in a legislative process. The draft must now be debated in the Bundestag and Bundesrat, and the government has not set a completion date in this announcement.

  • Citizens and privacy advocates should track the Bundestag committee debates to see whether the promised extra protections for professional secrets and the core of private life survive in the final text, and how the law defines the trigger for active measures.
  • Security and intelligence professionals can expect the Independent Control Council to become the central clearing point for the most intrusive surveillance operations; its pre-approval rules and staffing will determine how quickly BND and BfV can act.
  • Organisations running internet-facing infrastructure should note the concrete example cited by Berlin: a server that is assessed as the immediate source of a cyberattack could, under narrow conditions, be disabled by German intelligence rather than by police or prosecutors.