Germany seeks powers for spies to hack and disrupt attackers
Germany's government has proposed new legal powers allowing its intelligence agencies to proactively hack and disrupt the computer systems of foreign attackers, including by using offensive malware and denial-of-service attacks, as part of a broader strategy to bolster cybersecurity defenses.
Background
- Germany's domestic intelligence agency (BfV, or Federal Office for the Protection of the Constitution) is asking for expanded legal authority to conduct offensive cyber operations — i.e., hacking into attackers' systems and disrupting their activities, rather than just defending against them.
- This marks a shift from purely defensive posture to proactive "hack back" capabilities, a controversial approach that raises legal, ethical, and operational questions, especially given Germany's post-WWII privacy and surveillance sensitivities.
- The move reflects growing concern about state-sponsored cyberattacks from Russia, China, and other actors targeting critical infrastructure, government networks, and companies.
- Similar debates are ongoing in other countries — the US generally restricts offensive operations to the military (US Cyber Command), while the UK's GCHQ has broader offensive cyber authorities under the Intelligence Services Act.
- The proposal would need parliamentary approval and is likely to face scrutiny from civil liberties advocates concerned about mission creep and oversight.