On 13 November 2026 the Bundestag passed the largest rewrite of German intelligence law in the postwar era, by 308 votes to 190 with 71 abstentions, according to the Bundestag's own record of the debate. The CDU/CSU and SPD voted yes, the AfD and Die Linke voted no, and the Greens abstained. The law rewrites the rules for both the foreign service (BND) and the domestic agency (BfV).
The strongest case for the reform
The government's argument is not frivolous. Interior Minister Alexander Dobrindt called the bill the "reform of the century" and said it would let Germany's services operate "on equal footing with our European partners," The Record reported. Officials point to a hostile threat environment since Russia's invasion of Ukraine. When the powers were proposed, the Chancellery said they could be used to sabotage drone factories or chemical weapons laboratories, or to disable servers run by state-sponsored hackers. A service that can only watch an attack on German infrastructure and write a report about it is a poor defence.
The reform is also a response to a court. In its judgment of 19 May 2020 (1 BvR 2835/17), the Federal Constitutional Court held that the BND is bound by the Basic Law when it monitors foreigners abroad, and that the BND Act's provisions on strategic surveillance violated Article 10(1) and Article 5(1) of the Basic Law. The court's press release listed the defects: purposes that were not specific enough, missing protections for journalists and lawyers, no thresholds for data-sharing, weak safeguards on foreign cooperation, and oversight that was not comprehensive. It also said strategic surveillance is compatible with Article 10(1) "in principle." Parts of the new law answer that ruling directly.
What the law does well
The best feature is its oversight design. According to the government's Q&A on the reform, the Independent Control Council (Unabhängiger Kontrollrat) must approve particularly intrusive individual measures in advance. For BND signals intelligence, every measure needs its approval. Access to privately used IT systems needs prior approval. BfV protective measures are allowed only after the Council has confirmed their legality. The court-like panel that issues these approvals grows from six to twelve members. Physical coercion against people remains excluded for both services.
Pre-authorisation by a body with judicial character is the right model for active cyber operations. A hack can be hard to reverse and hard to contain, and ex post review alone cannot undo it. Doubling the panel also makes it more plausible that the Council can handle the volume without turning approvals into rubber stamps. The thresholds for the most aggressive tools are also stated in terms a court can apply: the BND's active measures target "imminent dangers" or "persistent and planned threats by foreign powers," and the BfV may act only against "extreme threats."
Where the law is under-constrained
The weak points are the data tools. The Greens' Konstantin von Notz said his party backed the BND law and the Control Council but rejected the BfV law, citing biometric internet matching "without relevant thresholds," per the Bundestag record. That criticism lands. The 2020 judgment treated missing thresholds as a constitutional defect, not a drafting detail. Biometric matching against open-internet imagery reaches everyone whose face is online, not just suspects. AI-based dataset analysis can sweep in large populations. The more automated the analysis, the less any human has decided who is a legitimate target.
The press-freedom position is also uneven. The Record notes that doctors get stronger protection while journalists and lawyers are "left with weaker safeguards." The 2020 court listed protections for journalists and lawyers among the missing safeguards. A reform that fixes confidentiality for one profession and not the others invites a second constitutional challenge.
The retention rules deserve scrutiny too. The government says BND content data may be kept for six months and traffic data for thirteen. Beck-aktuell's account of the cabinet draft puts metadata retention at 12 months, so the figure rose by a month between the draft and the final text. A month is small, but it moved upward in parliament without a published case that the longer period is needed.
What to watch
For a pro-innovation reader, the main worry is the precedent for state-run offensive capability. Intelligence-grade hacking depends on vulnerabilities an agency holds back, and every unpatched flaw it holds is one criminals can also find. Software vendors, open-source maintainers and security researchers all depend on timely disclosure. The law gives the Control Council a say over individual operations, but the government's own summary does not say the Council weighs the cost of withholding a vulnerability from vendors.
The law is due to enter into force on 31 December 2026, per the government's Q&A, which leaves little time for the Council to staff up. The practical test is whether the twelve-member panel gets the technical expertise to challenge the services on evidence.
Three amendments would help, short of a rewrite. Attach explicit thresholds and a human-review requirement to biometric matching and AI analysis. Bring journalists and lawyers up to the level now given to doctors. Require the Council to record its reasoning on vulnerability handling in each cyber operation. If Karlsruhe is asked again, those gaps are where the law is most exposed.