Overview
- The cabinet approved a more than 700‑page bill on Wednesday, August 12, 2026, that gives the BND and the domestic Verfassungsschutz new operational powers to intervene in cyberattacks, carry out so‑called hackbacks and, in defined cases, continue or start operations on German soil.
- The reform markedly expands data collection and automated analysis, authorises online searches and broader access to public and private video feeds, and explicitly permits AI‑assisted mass processing of personal data.
- Oversight is reorganised by strengthening a court‑like Unabhängiger Kontrollrat while removing parts of the Bundesdatenschutzbeauftragte’s supervisory role and limiting affected people’s rights to be informed about secret measures.
- The government narrowed one controversial proposal so the BSI is not obliged to hand known IT vulnerabilities to the BND, and the bill keeps a legal bar (Paragraph 51) on measures that deliberately target people’s lives in peacetime.
- The package drew wide political and civil‑society opposition over risks to the Trennungsgebot between police and intelligence, and legal experts and rights groups say they expect intensive Bundestag debate and likely constitutional complaints that could shape the law’s final scope.