The German government wants to give the Federal Intelligence Service (BND) and the domestic intelligence agency (Verfassungsschutz) considerably more powers. A nearly 700-page draft law, adopted by the cabinet on August 12, 2026, provides for expanded access to security vulnerabilities and vehicle data, among other things. The IT industry is warning about the consequences, particularly around the handling of zero-day vulnerabilities.
Data sharing all the way to zero-days
The draft, driven in part by requirements from the Federal Constitutional Court, obliges public and private bodies to share more data with the agencies, including about security vulnerabilities. The explanatory statement argues that with zero-day vulnerabilities in particular, this transfer creates significant added value. Until such a flaw is closed with a patch by the Federal Office for Information Security after being reported to the vendors, time passes that the BND can use for its work.
In addition, vehicle manufacturers and repair shops are to be required to hand over telemetry data. According to the Federal Ministry of the Interior, modern cars collect extensive data that allows conclusions about usage profiles, usage intensity, or the number of drivers. Usage data such as GPS position, mileage, or parking location could also reveal specific activities of the people involved.
Hackbacks become permitted
The planned intervention powers are especially controversial. The Verfassungsschutz is to be allowed to hack information technology systems too, covering both remote searches and source telecommunications surveillance. Both agencies are also to be permitted to delete or restrict attack tools or data on other people's computers. For threat prevention, the BND may alter or delete data, redirect or block data traffic, and restrict the operation of a system posing a threat. This is also known as a hackback. Federal Interior Minister Alexander Dobrindt said the reform turns Germany's intelligence services into real spy agencies.
IT industry associations welcome the reform in principle but view the new powers critically. That applies above all to the access to technical information, system copies, and running IT infrastructure. Such measures could affect highly sensitive company and customer data and create significant risks for the operation, security, and availability of digital services, warns the association of providers in the digital and telecommunications market (VATM). The industry association Bitkom joins the criticism.