Karlsruhe gave the Bundestag until the end of this year to rewrite the law governing German intelligence. The bill it produced takes powers that Karlsruhe, in two earlier rulings, treated as the reason the services could be held to a looser standard than the police.

On 12 August the German federal cabinet approved a rewrite of the law governing the Bundesnachrichtendienst and the Bundesamt für Verfassungsschutz. The interior ministry, in announcing it, called it the most extensive and fundamental overhaul of the statutory foundations of the two services in the history of the Federal Republic, and said the reform turns them into real intelligence services by conferring operational capabilities and active powers. The government draft now goes to the Bundesrat for its opinion before the Bundestag takes it up in the autumn.

Almost every account of the bill has argued about whether Germany should have these powers. That question is for Germans. The question for everyone else is why the bill exists at all, and the answer is a set of court rulings whose reasoning it unsettles.

The Deadline Nobody Mentions

In an order of 8 October 2024 the First Senate of the Federal Constitutional Court held that the BND’s powers to conduct strategic surveillance of international telecommunications for the detection of cyber threats were incompatible with the privacy of telecommunications under Article 10 of the Basic Law. The provision was allowed to continue, subject to conditions, only until the legislator enacts new provisions or until 31 December 2026 at the latest. If the Bundestag does not replace the framework by then, the power lapses.

That is why a seven-hundred-page bill is moving through parliament this autumn rather than across two or three sessions. It is not a government seizing a moment. It is a legislature working against a clock that a privacy ruling started.

What Karlsruhe Has Said About Operational Powers

The deadline is the well-known part of the order. The reasoning is not, and it is the reason the bill is interesting.

Explaining why surveillance of this reach can be tolerated at all, the Court set out the conditions attached to it. Among the factors reducing the severity of the interference, it counted that this surveillance is the exclusive responsibility of a service which in principle holds no operational powers of its own. It then stated the limit directly: powers of strategic surveillance are exceptional, they must be restricted to surveillance conducted by an authority that has no operational powers for public security measures, and they can be justified only by that authority’s particular tasks and the conditions under which it performs them.

The Court also treated the prospect of operational action as an aggravating factor rather than a neutral one. Surveillance of international traffic, it noted, reaches further into the domestic order than surveillance of purely foreign traffic precisely because it can be followed by operational action against people in Germany. That is the distinction the reform now removes.

None of this is new doctrine. In 2020 the Court held that the Federation may task the BND with early detection of dangers originating abroad as long as this does not give rise to operational powers, and in 2022 it held that the absence of operational follow-up powers is what justifies holding domestic services to modified versions of police thresholds. What matters is that the same reasoning appears in the very order that set the December deadline.

So the legislature is replacing a provision, on a clock set by a judgment, with a statute that removes the condition on which that judgment allowed the provision to stand at all. Whether that crosses a line or merely unsettles a premise is for the Court and not for this article. It is not a small question, and it is the one the autumn debate should be about.

What The Bill Actually Does, And What It Refuses To Do

The ministry’s own account is precise about the mechanism. Where a specific threat situation exists, and on an order that must be reviewed by the Independent Control Council, the BND acquires the additional task of acting proactively against threats, through measures the ministry itself illustrates: targeted penetration of the IT systems of chemical weapons laboratories or drone factories to sabotage production, or disabling the servers of state hacker groups and disinformation actors. The domestic service may act where a threat risks serious unrest across large parts of the population, or particularly grave damage from the intelligence activity of foreign powers. Surveillance and analysis expand alongside, and the most intrusive measures are reserved for a declared special intelligence situation requiring a two-thirds vote of the parliamentary oversight committee.

Two features are missed in coverage outside Germany. The reform creates, for the first time, a standalone statute governing legal oversight by the Independent Control Council. That is not a concession bolted on: the same order found oversight by a body serving in an auxiliary capacity inadequate and required professionalised supervision, so the supervisory half of the bill answers the judgment as much as the surveillance half does. And the draft is costed at a minimum of forty million euro in one-off expenditure for the BND and thirty-five million a year thereafter, exempted from the government’s own regulatory brake.

The refusals matter more than the coverage suggests. The bill bars measures intended to endanger life or physical safety, which leaves the BND with nothing resembling the paramilitary capability of France’s external service or the American equivalent. Set against the British arrangement, where there is no avowed paramilitary arm but a statutory provision permitting authorisation of acts abroad that would otherwise be unlawful, the German draft is narrower and more explicit. A country legislating in public what others hold in reserve is not the obvious candidate for European concern.

How It Was Presented, And How It Was Met

The framing in Berlin was not defensive. Sabotage, espionage, cyberattacks and covert action by foreign powers demand new answers, the interior minister said; the reform strengthens load-bearing pillars of the security architecture and gives the services operational capabilities and active powers against modern state terrorism and extremist violence.

The objections are worth carrying accurately, because they are not the ones a foreign reader would predict. The Greens argue the draft goes too far and lacks independent oversight. From the Left, Clara Bünger said conferring rights of intervention, sabotage powers and state hackbacks amounts to planning a new German secret police, and called the approach heedless of history. The Society for Civil Rights, in its published submission on the draft, makes the sharpest constitutional point: that operational powers, meaning active rights of intervention and defence, are being transferred to services built to collect.

That objection is the domestic form of the argument this article makes at European level. Inside Germany it is the separation principle, a post-war settlement with a specific history behind it. Outside Germany the same erosion appears as a question about which body may act, on whose territory, with what notice.

Germany Is Not Becoming An Outlier. It Is Ceasing To Be One

The framing of a German departure from restraint misses what officials themselves say. The head of the chancellery, Thorsten Frei, put the objective plainly in February: to be on an equal footing with European partners, noting that many attacks on Germany in recent years were thwarted only because allies with wider powers shared intelligence. Berlin has been the recipient of capabilities it did not possess. The reform closes that gap rather than opening a new one.

That should interest Brussels. The story is not one member state acquiring covert action but the last major holdout acquiring it, which means that within a year most of the Union’s larger members will hold, in law, the capacity to operate inside networks that do not stop at their borders. Germany passed a separate law in February allowing authorities to redirect traffic, shut down systems, and in serious cases delete or alter data on foreign servers. Whether that formulation carves out servers located in other member states is not apparent from the published reporting of that law, and it is the first question a European reader should want answered.

The Competence The Union Does Not Have

Article 4(2) of the Treaty on European Union reserves national security to each member state as its sole responsibility, and the German Court applied exactly that provision in this order, holding that Union data protection law does not reach the BND’s strategic surveillance and citing the Court of Justice’s own case law to the same effect. The reservation is therefore not a German convenience; it is judicially settled on both sides. That settles the legal question and leaves the practical one untouched. A German operation against infrastructure physically located in Ireland, or routed through a Dutch exchange point, or affecting a cloud service serving twenty member states, is a national security matter for Berlin and an unannounced event for everyone else. There is no publicly established European notification duty, no published deconfliction mechanism, and no open forum in which a member state can ask what happened on its territory. Arrangements between services are not published, so this is a statement about what exists on the record rather than a claim to know what does not exist at all.

The Bundestag is being asked to settle who authorises disruption and how operations abroad are coordinated with allies. Those questions do not stop at Germany, and no European institution is positioned to ask them. The Union has spent years building instruments against hybrid threats directed at it. For operations conducted by its own members it has no publicly established framework at all, and the reason usually given is Article 4(2). How far that reservation actually reaches, where an operation’s effects land in another member state, is a question the treaties do not answer on their face.

The Case For Leaving Well Alone

There is a strong argument that this is exactly as it should be. Intelligence sharing works on trust between services, not institutions, and every attempt to route it through Brussels has foundered on the objection that twenty-seven capitals cannot keep a secret. A notification requirement would be ignored, or leak, or hand a hostile service a map of European operations. The absence of a framework is a design choice services in every member state would defend.

The German case also argues for restraint on its own terms. This is a bill written under judicial supervision, published in full, debated in parliament, subject to advance approval by an independent council and a two-thirds vote for its sharpest instruments, and already promised a constitutional challenge. The ministry’s own answer to the separation objection is narrower than its critics allow: the services may intervene within tight limits where they detect dangers that other bodies, the police among them, cannot avert as effectively, and the separation principle is not otherwise to be touched. If every European service operated under those conditions, the continent would have a problem worth envying.

Both points hold against a supervisory role for Brussels. Neither holds against the narrower thing that is missing. The objection is to Union oversight of national operations. The gap is that member states have no way of learning, afterwards, that an operation occurred on their territory at all. Those are different problems, and only one of them requires anybody to share a secret.

What Could Be Settled Without Touching The Treaties

Two things, neither of which asks the Union to supervise anything.

1. A deconfliction channel between services, not institutions. Member states that intend to operate against infrastructure located in another member state should have a route to say so, at whatever level of detail they choose, before or after the fact. This exists between allies in other domains and does not require a Union competence, only a standing arrangement that member states agree among themselves.
2. A settled answer on liability. If a German operation degrades a service used by hospitals in another member state, no instrument presently says who answers for it, in which forum, and under whose law. That question will be decided eventually, either by agreement in advance or by a dispute after an accident. The first is cheaper.

The Bundestag is due to take up the bill in the autumn, under a deadline created by the Court’s ruling. What follows is not a German problem. Europe is about to be a continent of states with operational intelligence services and no shared account of what they may do to each other’s infrastructure, and the first time that matters will not be the moment anyone wants to begin the conversation.

---

Note On The Record:
The account of the reform’s content, its procedure, and its costs is taken from the Federal Ministry of the Interior’s own announcement of 12 August 2026, its legislative-procedure page, and the government draft published there. The full text runs to several hundred pages and was not read line by line; where the article describes what the bill does, it follows the ministry’s own description. No official English text exists and the German has been rendered here rather than quoted at length.

The Court materials are cited from the Federal Constitutional Court’s own English publications: the full text of the order of 8 October 2024 in 1 BvR 1743/16 and 1 BvR 2539/16, and the published judgments of 19 May 2020 and 26 April 2022. The passages on operational powers appear in the October order itself, in the section explaining why surveillance of this reach can be justified. An earlier draft of this article, following secondary reporting, first attributed that reasoning to the October order without having read it, then moved it to the two earlier judgments; reading the order established that it is in all three, and stated most directly in the 2024 text.

The characterisation of the reform as closing a gap rather than opening one is the author’s reading, supported by the chancellery’s own stated objective of parity with European partners. The German government does not describe it in those terms.

The proposition about the absence of a European deconfliction mechanism is confined in the text to what is publicly established. Arrangements between services are by their nature not published, and the absence of a public instrument is not proof that no arrangement exists.

Article 4(2) TEU is cited for the reservation of national security to member states. Its precise scope in relation to cross-border cyber operations is contested and is not settled here.

Sources consulted on 22 August 2026. Where a claim rests on a single report it is attributed in the text. Competitor publications are named where relied upon but not linked.

---

Source Register:

Claim	Source, date, and address
Ministry announcement of 12 August 2026: most extensive and fundamental overhaul of the statutory foundations of BND and BfV in the history of the Federal Republic; conferral of operational capabilities and active powers; BND proactive task on a specific threat situation subject to Independent Control Council order; illustrative measures against chemical weapons laboratories, drone factories and servers of state hacker groups; BfV threshold of serious unrest across large parts of the population or particularly grave damage from foreign intelligence activity	Federal Ministry of the Interior, press release
Legislative procedure: Referentenentwurf published 6 July 2026, government draft adopted 12 August 2026, Bundesrat opinion first and then the Bundestag; new BfV Act, new BND Act, and for the first time a standalone statute on legal oversight by the Independent Control Council	Federal Ministry of the Interior, legislative procedure page
Costs: at least EUR 40 million one-off and at least EUR 35 million a year for the BND; exemption from the one in, one out rule	Government draft, Federal Ministry of the Interior
Ministry position that services may intervene within tight limits where other bodies including the police cannot avert dangers as effectively, and that the separation principle is not otherwise to be touched	Legal Tribune Online, 6 July 2026
Society for Civil Rights submission on the draft: transfer of operational powers, meaning active rights of intervention and defence, to the services	Gesellschaft für Freiheitsrechte, published submission
Cabinet decision and route via Bundesrat then Bundestag	Grosswald analysis
Order of 8 October 2024, 1 BvR 1743/16 and 1 BvR 2539/16: BND strategic surveillance of international telecommunications for detecting cyber threats incompatible with Art. 10(1) Basic Law; provision continues subject to conditions until new provisions are enacted or 31 December 2026 at the latest	Federal Constitutional Court, press release 93/2024
Same order, full text: absence of operational powers counted among the factors reducing severity of interference; strategic surveillance powers must be restricted to an authority without operational powers for public security measures and justified only by that authority’s tasks and conditions; possibility of operational action against persons in Germany treated as aggravating; Art. 4(2) third sentence TEU applied to exclude Union data protection law, citing CJEU case law	Federal Constitutional Court, order of 8 October 2024
Judgment of 19 May 2020: the Federation may task the BND with early detection of dangers originating abroad, as long as this does not give rise to operational powers	Federal Constitutional Court, 1 BvR 2835/17
Judgment of 26 April 2022: the absence of operational follow-up powers is what justifies linking domestic intelligence data collection to modified versions of police thresholds; police powers characterised by operational responsibility must be narrowly and precisely defined	Federal Constitutional Court, 1 BvR 1619/17
Bar on measures endangering life or physical safety; comparison with French, American and British arrangements	The Record, Recorded Future News
Active measures including penetration of chemical weapons laboratories and drone factories, disabling servers of state-sponsored groups; oversight consolidated under the Independent Control Council with advance approval	Insight EU Monitoring
Special intelligence situation declared by a new security council and subject to a two-thirds vote of the parliamentary oversight committee; domestic reach of BND powers	interface, Germany’s reform of foreign and military intelligence
Thorsten Frei on parity with European partners and on attacks thwarted through allied intelligence	Reuters, February 2026
February 2026 cyber law permitting redirection of traffic, shutdown of IT systems, and deletion or alteration of data including on foreign servers, with court order obtainable up to three days after the fact in cases of imminent danger	Reuters, 27 February 2026
Questions parliament is being asked to settle on authorisation and coordination with allies; press-freedom concerns. NOTE: this source reported an expected September passage, which the ministry’s own procedure page supersedes; the article follows the ministry	European Times NOTE: this source reported an expected September passage, which the ministry’s own procedure page supersedes; the article follows the ministry
Dobrindt’s remarks at the Berlin press conference following the cabinet meeting of 12 August: Germany a daily target of espionage, sabotage, cyberattacks and covert action; operational powers conferred for the first time; the security architecture being remade	Reported accounts of the press conference, 12 August 2026
Konstantin von Notz on independent oversight; Clara Bünger on intervention rights, sabotage powers and state hackbacks; her characterisation as heedless of history	Euronews, reporting Tagesschau. Named in text, not linked, under the competitor rule
Society for Civil Rights on the blurring of constitutional boundaries between intelligence services, police and military, and its stated intention to challenge the bill	Reported statements by the organisation, August 2026
The bar on lethal operations. NOTE: this source also reported an expected September passage, superseded by the ministry’s procedure page	intelNews NOTE: this source also reported an expected September passage, superseded by the ministry’s procedure page