Germany Proposes Sweeping Intelligence Reform Granting BND and BfV Hack-Back, AI Surveillance, and Biometric Tracking Powers

The German government published a draft bill spanning roughly 650 to 700 pages on July 6, overhauling BND and BfV legal authorities 12. The draft would let both services intervene directly against active threats, including hack-back operations against ongoing cyberattacks that can disrupt or delete attacker infrastructure, plus expanded online searches of IT systems, biometric data matching, camera-feed access, AI-assisted analysis, and, for BfV specifically, a new and unprecedented authority to deliberately spread disinformation against attackers 1234. It also directs the BSI cyber agency to pass vulnerability findings, including undisclosed zero-day exploits, to the BND on an increasingly automated basis 2. The Interior Ministry cites an expanded Independent Control Council, replacing the G10 Commission with court-like pre-authorization, as the main check on the new powers, but netzpolitik and IT Boltwise reported the reform curbs oversight elsewhere: freedom-of-information requests to the agencies would require natural-person status and a demonstrable legitimate interest, a change critics call a de facto abolition of information freedom 123. Cabinet approval is expected this summer, ahead of a Federal Constitutional Court deadline requiring BND surveillance-law fixes by year's end, with the overhaul estimated to cost 40 million euros one-time plus 35 million euros annually for BND and 94 million euros in IT restructuring plus 269 million euros annually for BfV 1.