Germany Is Turning Its Intelligence Services Into Cyber Operators, Not Just Observers.
For much of the post-war era, Germany deliberately kept its intelligence services on a comparatively short leash.
That was not accidental.
The country’s history made extensive state surveillance politically and legally sensitive, and German intelligence agencies developed under far tighter constraints than many of their international counterparts.
The German government now wants to move that boundary.
On 12 August, the cabinet approved reforms that would significantly expand the powers of the BND foreign intelligence service and the domestic BfV. The proposals would allow intelligence services, under defined legal thresholds, to penetrate hostile IT systems, copy or delete data and disable infrastructure being used in foreign operations. The reforms still require parliamentary approval.
That is more than an intelligence reform.
It is a change in cyber doctrine.
Observation is becoming intervention
Intelligence agencies traditionally collect information.
They identify adversaries.
They monitor communications.
They analyse capabilities.
The proposed German framework moves further.
If an intelligence service can enter an adversary’s infrastructure and change, destroy or disable something inside it, the agency has moved from observer to operator.
The distinction is important.
Watching an attacker prepare an operation is intelligence.
Disabling the attacker’s server is action.
Deleting tooling is action.
Interfering with the infrastructure supporting a foreign campaign is action.
In cyber operations, the boundary between defence and offence becomes very thin once a government begins operating inside someone else’s systems.
Germany is not moving in isolation
The timing is particularly interesting.
The United States is simultaneously developing a framework that brings vetted private companies into government-directed offensive cyber operations.
Germany is taking a different route.
Rather than outsourcing capability, it is expanding what state intelligence services themselves may do.
The legal structures differ.
The direction does not.
Western governments increasingly appear unwilling to treat cyber defence solely as protecting domestic networks.
The emerging model includes disrupting the attacker before, during or after an operation.
The attribution problem does not disappear
That creates an obvious difficulty.
Cyber attribution is rarely perfect.
Infrastructure is rented.
Servers are compromised.
Traffic is proxied through innocent systems.
Attackers deliberately create false indicators.
A defensive organisation can tolerate uncertainty because it is protecting its own environment.
An organisation performing active disruption has less room for error.
Disable the wrong server and the action may affect an innocent third party.
Delete data from shared infrastructure and the consequences can extend beyond the intended adversary.
An attribution mistake therefore stops being an analytical error.
It becomes an operational event.
Sovereignty becomes a technical consideration
The internet does not respect national borders particularly well.
An attacker operating against Germany may use a server in another European country, infrastructure in the United States and compromised systems in Asia.
If German intelligence disables that infrastructure, the action may occur technically inside another jurisdiction.
That means incident responders, threat-intelligence teams and intelligence lawyers begin dealing with the same problem from different directions.
Where is the attacker?
Who owns the infrastructure?
Which country has jurisdiction?
Who has authorised intervention?
Cybersecurity becomes foreign policy surprisingly quickly.
The defensive value is nevertheless real
There is a reason governments want these capabilities.
Some infrastructure exists solely to attack others.
Malware-control servers can remain active for months.
Botnets can launch repeated operations.
Foreign intelligence services can maintain persistent infrastructure designed specifically to conduct espionage or disruption.
Waiting for the owner of every compromised server to respond through conventional legal channels can be too slow.
In those circumstances, the ability to disable an active capability can materially reduce risk.
The challenge is creating sufficient legal, technical and political controls around that power.
Germany’s proposals attempt to address part of that through defined thresholds and external oversight, including the Independent Control Council.
Whether that oversight will be sufficient will be part of the parliamentary debate.
Cyber defence is becoming more active
For security leaders outside government, the significance is broader than German intelligence law.
It shows where national cyber policy is moving.
Attackers have always operated across borders.
Defenders are increasingly being authorised to do the same.
That will change threat intelligence, incident response and attribution.
It may also change how private organisations interact with governments during major incidents.
If a compromised system inside a company becomes infrastructure in a state-backed campaign, the organisation may find itself participating in something much larger than its own incident response process.
The old model was comparatively clear.
Governments gathered intelligence.
Companies defended networks.
Attackers crossed the boundary.
That separation is becoming less reliable.
Germany’s proposed reforms are another sign that cyber defence is moving from watching the adversary towards interfering with the adversary.
The difficult question is no longer whether states will do this.
It is how they decide when they should.
Continue the series: European National Cyber & Digital Law Series index
