Several Bundestag members and other public figures have received Apple threat notifications, and Germany's cybersecurity agency says they should treat their phones as possibly compromised. The alerts are a security problem and a political test. They arrive days before a Paris meeting of the Pall Mall Process, the UK–French effort to rein in commercial spyware. This piece argues that the right German response is narrow, enforceable and evidence-led, and that it is not a panic-driven expansion of surveillance or of device restrictions.
What is actually known
The Federal Office for Information Security (BSI) says that since 29 October 2026 several Bundestag members and other public figures have received a vendor threat notification on Apple devices. Its guidance page states that it does not know whether the notifications mean actual compromises or only attempted attacks. The BSI wrote to Bundestag members on 30 October, advising recipients to assume their device may be compromised, to update the operating system immediately unless they plan forensic analysis, and to contact the agency (BSI).
Euronews reported on 2 November that Digital Minister Karsten Wildberger confirmed members of the Bundestag and federal government were among the recipients. It also reported that nobody has said who is behind the attack or how many people were hit (Euronews). The Record reported that, according to Der Spiegel, recipients included staff, lawmakers and journalists travelling with Chancellor Friedrich Merz in Asia. Green co-leader Franziska Brantner said on 3 November that she was among them (The Record).
The wave itself is global. Apple's notification reached users in 99 countries, according to a screenshot posted by researcher Costin Raiu. He said he saw no signs in the logs that would identify the responsible actor (The Record). Apple does not attribute these attacks. Its support page describes notifications as high-confidence alerts, while acknowledging that investigations 'can never achieve absolute certainty' (Apple Support).
Those limits matter for an evidence-based publication. Attribution is unknown, and the BSI's 'assume compromise' advice is a precaution, not a forensic finding. Nobody should write policy as though a named vendor or government has been proven responsible.
The strongest case for tougher rules
The case for aggressive intervention is serious. Mercenary spyware is built to defeat the protections ordinary users rely on. Citizen Lab's John Scott-Railton argues that European governments have tolerated the industry by becoming customers, and that Germany can now create real deterrence (The Record). The targets here are the people who write Germany's foreign and technology policy, so the risk is not abstract. A market that sells intrusion tools to whoever pays also proliferates, and Green MEP Hannah Neumann warned of exactly that in the same report. If voluntary norms fail, binding export controls and procurement bans look like the only credible answer.
Where proportionality should bite
The Pall Mall Process began at a London conference co-hosted by the UK and France on 6 February 2024. It is a dialogue among states, industry and civil society, not a treaty (GOV.UK). The Record reports that voluntary industry guidelines are due to be unveiled at the 11–12 November Paris meeting. Scott-Railton warned that the companies giving feedback there could even be among those captured in Apple's latest alerts.
That is a fair criticism, and it points to where Berlin can add value without overreaching. Three measures fit the evidence.
- Procurement conditions. Germany can decide what its own agencies buy. A rule that excludes vendors with documented abuse, backed by independent oversight of any domestic use, imposes costs on bad actors without touching legitimate security research or the wider software industry.
- Narrow export scrutiny. Controls should target intrusion capabilities sold as products, with clear licensing criteria. Broad restrictions on vulnerability research would weaken the defenders who find and report the bugs that spyware exploits.
- Defensive investment. The BSI's reaction was fast: its letter followed the first alerts by about a day. Funding forensic support for officials and journalists, and promoting features such as Lockdown Mode (which the BSI recommends), protects users directly.
The approach to avoid is the reflex response. Mandating weaker encryption, banning categories of devices, or creating broad new state hacking powers would trade a documented harm for a speculative one. Open-internet and free-speech advocates should resist any package that treats spyware as a reason to expand surveillance authority.
What to watch in Paris
Voluntary guidelines are only as strong as their enforcement. The test in Paris is whether participants accept concrete commitments on vendor accountability, transparency about government use, and consequences for abuse. Germany arrives as a victim state, which gives it credibility to push for measurable obligations over aspirational language.
The quieter lesson is about transparency. Apple's notifications are one of the few independent signals the public gets about targeting, and the Record notes the company had not yet publicised the latest round on its website. Governments that want to fight spyware should protect and support such disclosure, not discourage it, and should commit to publishing how many of their own lawful interception tools they acquire and under what authorisation.
Germany should respond to attribution when evidence exists, and it should keep its rules narrow, accountable and aimed at the market that makes these attacks possible.